title: How to handle HTTP Basic Auth with URL encoding in Express (Node.js)
body: <p>I'm receiving callbacks from an API we're using (<a href="https://secure.na1.echosign.com/public/docs/restapi/v5" rel="nofollow noreferrer">Adobe Sign API</a>). The only method available to authenticate these callbacks is HTTP Basic Auth, using <a href="https://en.wikipedia.org/wiki/Basic_access_authentication#URL_encoding" rel="nofollow noreferrer">URL encoding</a> (<strong><em>not headers</em></strong>).</p>
  
  <p>Documentation:</p>
  
  <blockquote>
    <p><strong>callbackInfo (string, optional):</strong> A publicly accessible url to which Adobe Sign will do an HTTP GET operation every time there is a new agreement event. HTTP authentication is supported using standard embedded syntax - i.e. <a href="http://username:password@your.server.com/path/to/file" rel="nofollow noreferrer">http://username:password@your.server.com/path/to/file</a>.</p>
  </blockquote>
  
  <p>How can I access the <code>username:password@</code> part of the URL, in order to validate the credentials? It doesn't seem to be available from the Request object (I dumped the entire object to <code>console.error()</code> and can't find the credentials anywhere in there). :(</p>
  
  <p>I'm using Express 4.14.0, npm 3.10.8 &amp; Node.js 7.0.0 (I could upgrade to a newer version if that would help).</p>
  
  <p>Unfortunately, the Adobe Sign support is not helpful at all.</p>
  
  <p><strong><em>Edit:</strong> I already support the HTTP Basic authentication header (<code>Authorization</code>), but once again, it is <strong>not provided</strong> in this callback. Requests using the header show up in my nginx access logs with the username, but the callback doesn't show any username (which makes sense since the header isn't there). The only credentials available are in the <code>username:password@</code> part of the URL. I didn't even know this was possible, <a href="http://www.ietf.org/rfc/rfc1738.txt" rel="nofollow noreferrer">but apparently it's part of the URL RFC</a>, and still supported today (see section <code>3.1. Common Internet Scheme Syntax</code>). I'm literally just receiving a simple GET request with no headers at all. Something like <a href="https://adobesign:verysecurepassword@myservice.com/callbacks" rel="nofollow noreferrer">https://adobesign:verysecurepassword@myservice.com/callbacks</a>.</em></p>
  
  <p><em>For failed authentications, I'm returning a <code>401</code> response with the <code>WWW-Authenticate</code> header set to <code>Basic</code>, but it doesn't help in this case (only makes browsers prompt for username/password, but doesn't affect the callback).</em></p>