verdaccio: Publishing scoped package does not work due to slash escape, even when not using reverse proxy

Describe the bug After updating Verdaccio to latest version (4.11.0), publishing a scoped package with latest version of Verdaccio does not work due to “/” being escaped This has been reported before (see #1778) occurring when Verdaccio is used behind a reverse proxy, but in my case this happens with the default install and starting Verdaccio from the CLI, per: https://verdaccio.org/docs/en/installation

npm ERR! code E404
npm ERR! 404 Not Found - PUT http://<domain>/@<scope>%2f<package> - no such package available
npm ERR! 404 
npm ERR! 404  '@<scope>/<package>@1.2.1' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.

Expected behavior Should be able to install scoped package…

Workaround I reverted to an older version (4.0.3) and it works with that.

About this issue

Original URL
State: open
Created 3 years ago
Reactions: 4
Comments: 18 (6 by maintainers)

Most upvoted comments

Found the issue. The storage directory needs to have the proper permissions.

Then ran into an issue with Internal Server Error while trying to sign in. Turns out it was a htpasswd file permissions error.

File read errors should be bubbled up to the logs.

FallingSnow on Oct 5, 2021

Here is the test repo. Error occurs for me when using it.

https://github.com/FallingSnow/Verdaccio-2096

FallingSnow on Sep 26, 2021

Brb, gotta change some passwords lol.

FallingSnow on Sep 26, 2021

Lol, I pressed ctrl+enter to add a line above and it submitted it. Sorry, thank you!

FallingSnow on Sep 26, 2021

Thanks @FallingSnow 😃 I’ll take it from here, thanks for the debugging session, I’ll finish my PR #2447 then move on to this one see what I get.

juanpicado on Sep 23, 2021

I’m experiencing this too. Using verdaccio 5.16.0 behind a traefik proxy, both on docker. Client logs are the same as the original posters. Server logs are below:

 http --- 172.21.0.10 requested 'PUT /-/user/org.couchdb.user:admin/-rev/undefined'
 http --- 201, user: admin(108.162.215.152 via 172.21.0.10), req: 'PUT /-/user/org.couchdb.user:admin/-rev/undefined', bytes: 197/648
 http --- 172.21.0.10 requested 'PUT /@<scope>%2f<package>'
 info --- auth/allow_action: access granted to: undefined
 info --- admin is allowed publish for @<scope>/<package>
 http --- 404, user: admin(172.69.35.213 via 172.21.0.10), req: 'PUT /@<scope>%2f<package>', error: no such package available
 http --- 172.21.0.10 requested 'GET /'
 http --- 200, user: null(172.68.133.66 via 172.21.0.10), req: 'GET /', bytes: 0/476
 http --- 172.21.0.10 requested 'GET /-/verdaccio/packages'
 http --- 304, user: null(172.68.133.66 via 172.21.0.10), req: 'GET /-/verdaccio/packages', bytes: 0/0

FallingSnow on Sep 22, 2021