uclient-fetch: basic HTTP authentication is broken

[rany2]

@nbd168, please take a look at this. I have provided instructions to repro:

$ apk info uclient-fetch
uclient-fetch-2026.01.31~931bbfeb-r1 description:
Tiny wget replacement using libuclient

uclient-fetch-2026.01.31~931bbfeb-r1 webpage:


uclient-fetch-2026.01.31~931bbfeb-r1 installed size:
24 KiB
$ uclient-fetch -qO- --user=rany --password=epic https://httpbin.org/get
{
  "args": {},
  "headers": {
    "Host": "httpbin.org",
    "User-Agent": "uclient-fetch",
    "X-Amzn-Trace-Id": "<redacted>"
  },
  "origin": "<redacted>",
  "url": "https://httpbin.org/get"
}
$ curl -o- https://rany:epic@httpbin.org/get
{
  "args": {},
  "headers": {
    "Accept": "*/*",
    "Authorization": "Basic cmFueTplcGlj",
    "Host": "httpbin.org",
    "User-Agent": "curl/8.15.0",
    "X-Amzn-Trace-Id": "<redacted>"
  },
  "origin": "<redacted>",
  "url": "https://httpbin.org/get"
}

[rany2]

This is impacts me because it prevents HE 6in4 tunnels from updating their tunnel IP.

[rany2]

Well, the reproduction steps are not actually that useful as it seems that uclient-fetch cares about a basic challenge being issued; but I do believe that HTTP authentication in general is broken somehow as HE tunnel IP cannot be updated anymore and a 401 is returned.