Deprecation notice for authentication via URL query parameters

[mbcod3]

I am using octokit request.js in this way

const { request } = require("@octokit/request");

request("GET /repos/{owner}/{repo}/contents/{path}", {
        headers: {
          accept: "application/vnd.github.v3+json",
          authorization: "token my personal access token here",
        },
...other code here

I am getting github deprecation notice:

Please use the Authorization HTTP header instead, as using the access_token query parameter is deprecated. If this token is being used by an app you don't have control over, be aware that it may stop working as a result of this deprecation.

I dont know what to do. I am already using authorization in the header as shown above. Any help is much appreciated.

[gr2m]

do you pass access_token as another parameter to request?

[mbcod3]

No I pass access_token inside headers authorization where I wrote "my personal access token here" above

[gr2m]

can you please share a minimal code example that triggers the error for you? I'm not able to reproduce it.

https://runkit.com/ is great to create these reproducible test cases, you can set a token as an environment variable and use it in the notebook

[mbcod3]

This is code from firebase function. I basically get a private repo to get sha and then make a commit to specific json file in that private repo. This code is inside async function. documents is data that is saved to backup.json file. Other than headers object everything is from github rest api docs page. I have deleted some part of my access token here.

 const repo = await request("GET /repos/{owner}/{repo}/contents/{path}", {
    headers: {
      accept: "application/vnd.github.v3+json",
      authorization: "token ghp_9DE9inzejDA",
    },
    owner: "mbcod3",
    repo: "myRepo",
    path: "backup.json",
  });

  request("PUT /repos/{owner}/{repo}/contents/{path}", {
    headers: {
      accept: "application/vnd.github.v3+json",
      authorization: "token ghp_9DE9in9e3zejDA",
    },
    owner: "mbcod3",
    repo: "myRepo",
    path: "backup.json",
    sha: repo.data.sha,
    message: "3rd",
    content: Base64.encode(JSON.stringify(documents)),
  });

[wolfy1339]

You really shouldn't post your token in public view...

[mbcod3]

You really shouldn't post your token in public view...

Thats not the full token

[mbcod3]

Thats the code that got me github deprecation notice. I was thinking maybe ocktokit/request.js send the access token as parameter because I am not. So confusing

[gr2m]

I tried to reproduce your problem, but no luck:
https://runkit.com/gr2m/octokit-request-js-382

The code works as expected:
gr2m/sandbox@e847ae1

I don't get any deprecation notice

[mbcod3]

The code does work for now on my end too because deadline to end sending access token via ur query parameter is September 2021. Also the deprcation notice is only sent once a month as stated in the email and not everytime on each code run.

Other than I dont know much but I still appreciate your time and effort for resolving this issue. Thank you.

You can see the github post about this issue here:

https://developer.github.com/changes/2020-02-10-deprecating-auth-through-query-param/

[gr2m]

I am aware of the deprecation of sending the access token as query parameter. But @octokit/request does not set that token. I'm 100% sure that this code is not triggering the notification for you.

I've update the runkit notebook. This time I explicitly mock the http requests. No query parameters are set:
https://runkit.com/gr2m/octokit-request-js-382/2.0.0

[mbcod3]

I am only interacting with that repo and access token with that code. Btw I replaced ocktokit with axios. Would you kindly tell me if this is using authorization header as required by github and not using query parameters?

 const repo = await axios({
    method: "get",
    url: "https://api.github.com/repos/mbcod3/myRepo/contents/backup.json",
    headers: {
      accept: "application/vnd.github.v3+json",
      authorization: "token ghp_9DE9in9u3zejDA",
    },
  });

  axios({
    method: "put",
    url: "https://api.github.com/repos/mbcod3/myRepo/contents/backup.json",
    headers: {
      accept: "application/vnd.github.v3+json",
      authorization: "token ghp_9DE3zejDA",
    },

    data: {
      content: Base64.encode(JSON.stringify(documents)),
      sha: repo.data.sha,
      message: "backup",
    },
  });

[gr2m]

Looks good, not query parameters are set.

Let me know if that resolves the problem for you. I’m going to close the issue for the time being as there is nothing actionable left to do for us