{"action":"created","issue":{"url":"https://api.github.com/repos/sindresorhus/got/issues/105","labels_url":"https://api.github.com/repos/sindresorhus/got/issues/105/labels{/name}","comments_url":"https://api.github.com/repos/sindresorhus/got/issues/105/comments","events_url":"https://api.github.com/repos/sindresorhus/got/issues/105/events","html_url":"https://github.com/sindresorhus/got/issues/105","id":107304474,"number":105,"title":"Auth request breaks if password has # (hash) in it","user":{"login":"Jakobud","id":87356,"avatar_url":"https://avatars.githubusercontent.com/u/87356?v=3","gravatar_id":"","url":"https://api.github.com/users/Jakobud","html_url":"https://github.com/Jakobud","followers_url":"https://api.github.com/users/Jakobud/followers","following_url":"https://api.github.com/users/Jakobud/following{/other_user}","gists_url":"https://api.github.com/users/Jakobud/gists{/gist_id}","starred_url":"https://api.github.com/users/Jakobud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jakobud/subscriptions","organizations_url":"https://api.github.com/users/Jakobud/orgs","repos_url":"https://api.github.com/users/Jakobud/repos","events_url":"https://api.github.com/users/Jakobud/events{/privacy}","received_events_url":"https://api.github.com/users/Jakobud/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-19T02:22:37Z","updated_at":"2015-09-20T10:33:58Z","closed_at":"2015-09-20T10:33:58Z","body":"I was given an API ID and password for a service. The password has a `#` in it. When using got to make a put request, it bugs out. I have traced the problem back to the `#` in the password. Here is something to recreate it (at least using the API service I am using..., but you should be able to simulate something similar with some other service you make requests to) :\r\n\r\n```js\r\n// First lets do a normal https request to show that this works:\r\nvar id = \"test\";\r\nvar pass = \"45d3ps#453\";\r\n\r\nvar https = require('https');\r\nvar options = {\r\n\t'method': 'POST',\r\n\t'host': 'account.myservice.com',\r\n\t'path': '/api/token',\r\n\t'auth': id + \":\" + pass,\r\n\t'headers': {\r\n\t\t'Content-Type': 'application/x-www-form-urlencoded'\r\n\t}\r\n};\r\n\r\nvar req = https.request(options, function(res){\r\n\tconsole.log(res.statusCode);\r\n\tconsole.log(res.headers);\r\n\r\n\tres.on('data', function(data){\r\n\t\tprocess.stdout.write(data);\r\n\t});\r\n});\r\n\r\nreq.on('error', function(err){\r\n\tconsole.log(\"Error\", err);\r\n});\r\n\r\nreq.write('request=credentials');\r\nreq.end();\r\n```\r\nI get the expected response:\r\n```js\r\n200\r\n{ 'content-type': 'application/json; charset=UTF-8',\r\n  'cache-control': 'no-store',\r\n  date: 'Fri, 18 Sep 2015 22:05:09 GMT',\r\n  'accept-ranges': 'bytes',\r\n  vary: 'Accept-Charset, Accept-Encoding, Accept-Language, Accept',\r\n  pragma: 'no-cache',\r\n  connection: 'close' }\r\n{\"expires_in\":1799,\"token_type\":\"api-test\",\"access_token\":\"dk393kd-3i9dk3-39dk\"}\r\n```\r\n\r\nSo that works fine. Now with `got`:\r\n```js\r\nvar id = \"test\";\r\nvar pass = \"45d3ps#453\";\r\n\r\nvar got = require('got');\r\n\r\nvar url = \"https://\" + id + \":\" + pass + \"@account.myservice.com/api/token\";\r\n\r\nvar options = {\r\n\t'body': 'request=credentials',\r\n\t'headers': {\r\n\t\t'Content-Type': 'application/x-www-form-urlencoded'\r\n\t}\r\n}\r\n\r\ngot.post(url, options, function(err, data, res){\r\n\tif (err) {\r\n\t\tconsole.log(\"Error\", err);\r\n\t} else {\r\n\t\tconsole.log(data, res);\r\n\t}\r\n});\r\n```\r\nI get:\r\n```js\r\nError { [RequestError: getaddrinfo ENOTFOUND test]\r\n  message: 'getaddrinfo ENOTFOUND test',\r\n  code: 'ENOTFOUND',\r\n  host: 'test',\r\n  hostname: 'test',\r\n  method: 'POST',\r\n  path: '/:45d3ps' }\r\n```\r\n\r\nThe first thing I noticed was that the return headers path had part of the password in it. It didn't take long to figure out that the `#` hash was causing some issues with the url. Honestly, I'm not sure (according to internet w3c standards) if it's even valid to have a `#` hash in the username or password section of a URL since a hash is typically used at the end of a url.... But it's working for Node's vanilla https module so I dunno...\r\n\r\nAny thoughts on this?\r\n"},"comment":{"url":"https://api.github.com/repos/sindresorhus/got/issues/comments/141774479","html_url":"https://github.com/sindresorhus/got/issues/105#issuecomment-141774479","issue_url":"https://api.github.com/repos/sindresorhus/got/issues/105","id":141774479,"user":{"login":"floatdrop","id":365089,"avatar_url":"https://avatars.githubusercontent.com/u/365089?v=3","gravatar_id":"","url":"https://api.github.com/users/floatdrop","html_url":"https://github.com/floatdrop","followers_url":"https://api.github.com/users/floatdrop/followers","following_url":"https://api.github.com/users/floatdrop/following{/other_user}","gists_url":"https://api.github.com/users/floatdrop/gists{/gist_id}","starred_url":"https://api.github.com/users/floatdrop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/floatdrop/subscriptions","organizations_url":"https://api.github.com/users/floatdrop/orgs","repos_url":"https://api.github.com/users/floatdrop/repos","events_url":"https://api.github.com/users/floatdrop/events{/privacy}","received_events_url":"https://api.github.com/users/floatdrop/received_events","type":"User","site_admin":false},"created_at":"2015-09-20T10:33:57Z","updated_at":"2015-09-20T10:33:57Z","body":"@Jakobud on second thought you can pass `#`, but you must use [`encodeURIComponent`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent):\r\n\r\n```js\r\nlet res = require('http').get('http://user:' + encodeURIComponent('pa##word')+ '@google.com', function (){});\r\n\r\nconsole.log(res._headers); // => GET / HTTP/1.1\\r\\nHost: google.com\\r\\nAuthorization: Basic dXNlcjpwYSMjd29yZA==\\r\\nConnection: close\\r\\n\\r\\n\r\n```\r\n\r\n@sindresorhus yes, `username:password` is deprecated by [rfc3986](https://tools.ietf.org/html/rfc3986#section-3.2.1), but this format is supported by Node `url.parse` method, so I don't see why we should explicitly forbid that."}}