{"record":{"id":"058d1527fed41f5a","repo":"RocketChat/Rocket.Chat","slug":"auth-option-should-be-of-the-form-username-passwo","errorCode":null,"errorMessage":"auth option should be of the form \"username:password\"","messagePattern":"auth option should be of the form \"username:password\"","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/app/apps/server/bridges/http.ts","lineNumber":38,"sourceCode":"\t}\n\n\tprotected async call(info: IHttpBridgeRequestInfo): Promise<IHttpResponse> {\n\t\t// begin comptability with old HTTP.call API\n\t\tconst url = new URL(info.url);\n\n\t\tconst { request, method } = info;\n\n\t\tconst { headers = {} } = request;\n\n\t\tlet { content } = request;\n\n\t\tif (!content && typeof request.data === 'object') {\n\t\t\tcontent = request.data;\n\t\t}\n\n\t\tif (request.auth) {\n\t\t\tif (request.auth.indexOf(':') < 0) {\n\t\t\t\tthrow new Error('auth option should be of the form \"username:password\"');\n\t\t\t}\n\n\t\t\tconst base64 = Buffer.from(request.auth, 'ascii').toString('base64');\n\t\t\theaders.Authorization = `Basic ${base64}`;\n\t\t}\n\n\t\tlet paramsForBody;\n\n\t\tif (content || isGetOrHead(method)) {\n\t\t\tif (request.params) {\n\t\t\t\tObject.keys(request.params).forEach((key) => {\n\t\t\t\t\tif (request.params?.[key]) {\n\t\t\t\t\t\turl.searchParams.append(key, request.params?.[key]);\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t}\n\t\t} else {\n\t\t\tparamsForBody = request.params;","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/app/apps/server/bridges/http.ts#L20-L56","documentation":"When an App makes an HTTP request with `options.auth`, `AppHttpBridge.call` (http.ts:36-43) builds a Basic auth header by base64-encoding the value. It first checks for a ':' separator; if none is present it throws before the request is sent. Per IHttpRequest (apps-engine IHttp.ts:37), `auth` must be in the form 'username:password'.","triggerScenarios":"`http.get(url, { auth: 'useronly' })` — no colon. Also an auth string sourced from config/env that was not formatted as user:password.","commonSituations":"Username-only value passed; concatenating user+password without a ':'; typo in templating; credentials read from a secret store that returns them as separate fields.","solutions":["Format auth as `${username}:${password}`.","Set the Authorization header manually if your scheme differs from Basic.","Validate `auth.includes(':')` before calling the accessor."],"exampleFix":"// before\nawait http.get(url, { auth: username })\n// after\nawait http.get(url, { auth: `${username}:${password}` })","handlingStrategy":"validation","validationCode":"if (options.auth != null && !options.auth.includes(':')) {\n  throw new Error('IHttpRequest.auth must be \"username:password\"');\n}\nawait http.get(url, options);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always build auth via a template literal `${user}:${pass}`.","Prefer an explicit Authorization header for non-Basic schemes.","Validate credentials sourced from secret stores before passing them as auth."],"tags":["apps-engine","http","networking","validation"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}