implement nodeDistAuthHeader configuration option - #329
bienzaaron wants to merge 4 commits into
Conversation
✅ Deploy Preview for yarn-v6 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
| "nodeDistAuthHeader": { | ||
| "_package": "@yarnpkg/core", | ||
| "title": "Authorization header to send when downloading Node.js distributions.", | ||
| "description": "When specified, the value will be sent as an `Authorization` header when fetching both the release index and distribution archives from `nodeDistUrl`. This is typically paired with a custom `nodeDistUrl` for an internal node.js distribution mirror.", | ||
| "type": ["string", "null"], | ||
| "_examples": [ | ||
| { | ||
| "description": "Do not pass an `Authorization` header.", | ||
| "value": null | ||
| }, | ||
| { | ||
| "description": "Pass a Bearer token in the `Authorization` header.", | ||
| "value": "Bearer a-token-here" | ||
| }, | ||
| { | ||
| "description": "Pass a Bearer token from an environment variable.", | ||
| "value": "Bearer ${NODE_DIST_BEARER_TOKEN}" | ||
| } | ||
| ] | ||
| }, |
There was a problem hiding this comment.
I also considered a scoped structure similar to npmRegistries -> npmAuthToken :
// .yarnrc.yml
nodeDistAuth:
"https://mirror-one.example.com/node/dist":
authorization: "Bearer a-token"
"https://mirror-two.example.com/node/dist":
authorization: "Bearer different-token"though I'm not sure its necessary. My only concern is that with the current scalar nodeDistAuthHeader config is that if a malicious actor could inject a different nodeDistUrl, they could send the request to a malicious url and capture the token.
6303d62 to
ebe61de
Compare
ebe61de to
1d926d3
Compare
⏱️ Benchmark Resultsgatsby install-full-cold
📊 Raw benchmark data (gatsby install-full-cold)Base times: 4.142s, 4.064s, 4.186s, 4.137s, 4.169s, 4.107s, 4.024s, 4.196s, 4.171s, 4.154s, 4.059s, 3.975s, 4.202s, 4.178s, 3.967s, 4.002s, 4.095s, 4.088s, 4.031s, 4.034s, 4.043s, 4.166s, 4.047s, 3.996s, 4.043s, 4.219s, 4.297s, 4.248s, 4.128s, 4.025s Head times: 4.097s, 4.116s, 4.143s, 3.968s, 4.055s, 4.069s, 4.021s, 4.330s, 4.063s, 4.518s, 4.295s, 4.208s, 4.188s, 4.012s, 4.086s, 4.068s, 4.009s, 4.099s, 3.958s, 4.078s, 4.064s, 4.258s, 4.153s, 4.049s, 4.024s, 4.016s, 3.903s, 4.126s, 4.022s, 4.138s gatsby install-cache-only
📊 Raw benchmark data (gatsby install-cache-only)Base times: 2.085s, 1.587s, 1.298s, 1.233s, 1.483s, 1.412s, 1.250s, 1.282s, 1.506s, 1.228s, 1.341s, 1.362s, 1.369s, 1.382s, 1.304s, 1.401s, 1.267s, 1.718s, 1.241s, 1.260s, 1.448s, 1.290s, 1.242s, 1.274s, 1.268s, 1.257s, 1.291s, 1.240s, 1.257s, 1.209s Head times: 1.371s, 1.208s, 1.334s, 1.394s, 1.294s, 1.291s, 1.215s, 1.242s, 1.238s, 1.228s, 1.310s, 1.255s, 1.206s, 1.223s, 1.284s, 1.250s, 1.208s, 1.681s, 2.126s, 1.525s, 1.226s, 1.248s, 1.394s, 1.321s, 1.252s, 1.266s, 1.270s, 1.258s, 1.274s, 1.299s gatsby install-cache-and-lock (warm, with lockfile)
📊 Raw benchmark data (gatsby install-cache-and-lock (warm, with lockfile))Base times: 0.362s, 0.350s, 0.338s, 0.343s, 0.444s, 0.342s, 0.383s, 0.472s, 0.530s, 0.336s, 0.458s, 0.337s, 0.376s, 0.469s, 0.347s, 0.363s, 0.362s, 0.510s, 0.362s, 0.352s, 0.366s, 0.352s, 0.418s, 0.374s, 0.356s, 0.346s, 0.379s, 0.352s, 0.347s, 0.362s Head times: 0.367s, 0.456s, 0.433s, 0.416s, 0.540s, 0.456s, 0.502s, 0.550s, 0.416s, 0.660s, 0.637s, 0.378s, 0.348s, 0.680s, 0.376s, 0.437s, 0.399s, 0.360s, 0.434s, 0.425s, 0.480s, 0.423s, 0.353s, 0.346s, 0.344s, 0.349s, 0.347s, 0.349s, 0.393s, 0.345s |
This branch was successfully deployed
2 participants
Adds
nodeDistAuthHeaderconfiguration option to authenticate requests to Node.js distribution mirrors.This supports corporate environments that block public distribution endpoints in favor of authenticated private mirrors. The header applies to both release index and archive downloads.