Missing authorization header with tarball URL + basic auth

[MKRhere]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

8.11.0

Which area(s) of pnpm are affected? (leave empty if unsure)

CLI, Package manager compatibility

Reproduction steps

Run a server that echoes req.headers, such as

import { createServer } from "node:http";

createServer((req, res) => {
	console.log(req.headers);
	res.end();
}).listen(3000);

pnpm add with a secret in the URL:

pnpm add http://secret:user@localhost:3000/pkg

Describe the Bug

The secret is not delivered to the server via an authorization header as it is supposed to be.

Expected Behavior

npm and yarn deliver the token correctly, as the header:

authorization: 'Basic c2VjcmV0OnVzZXI='

which decodes to "secret:user" as expected. pnpm should do the same.

Which Node.js version are you using?

v20.8.1

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

Debian GNU/Linux 12 (bookworm) x86_64 (kernel 6.1.0-13-amd64)

[KSXGitHub]

One small correction, it should be user:secret, not secret:user. You can confirm it by new URL() on your browser console. (I wasted time debugging this mistake)

[MKRhere]

Sorry, that's my bad! It was a typo. Thanks for the PR ❤️

[KSXGitHub]

@MKRhere No worries. I have created a PR: #7376