[plum117]

Why CDN credentials exist

• edgedriver: requested in Support Custom CDN URL with Basic Auth credentials webdriverio-community/node-edgedriver#282 (a company mirror of the Microsoft CDN that needs Basic auth, configured as edgedriver_cdnurl=https://$USERNAME:$PASSWORD@mirror… in .npmrc), added in feat: support custom CDN URL with Basic Auth credentials (#282) webdriverio-community/node-edgedriver#534.
• geckodriver: supported since 2017 (fix(url): Pass parsed url to got webdriverio-community/node-geckodriver#28, a GitHub token in GECKODRIVER_CDNURL through got), lost unnoticed when the 2023 rewrite moved to node-fetch v3, which rejects credentials in URLs.
• Over https:// the header is encrypted, and undici drops Authorization on a cross-origin redirect (checked: a mirror redirecting to another origin; only the mirror got the header). The docs now say to keep credentials on https:// URLs.

Summary

• CDN credentials. fetch rejects a URL with user:pass@ ("Request cannot be constructed from a URL that includes credentials"). edgedriver stripped them only for the zip download, so every version lookup (LATEST_RELEASE_*, LATEST_STABLE, …) with an authenticated EDGEDRIVER_CDNURL failed, including the fallback after a 404. geckodriver never stripped them, so an authenticated GECKODRIVER_CDNURL failed on its first request. Both now send them as a Basic Authorization header on every CDN request. Not a regression: Node's built-in fetch rejected these URLs too.
• The credentials are percent-decoded first (p%40ss is sent as p@ss; a bare %, as in p%ss, stays as text instead of leaving the credentials in the URL), and the Fetching latest version from … / Downloading Geckodriver from … log lines, which end up in WebdriverIO's log files, no longer show them.
• Upgrade note. Adds what was missing: CommonJS safaridriver start() / stop() no longer return a Promise (written for docs: map driver majors to WebdriverIO majors and note the v8 upgrade #25 but pushed after it merged), the proxy variables now apply (6.x / 7.x ignored them: add the CDN host to NO_PROXY if needed), safaridriver pipes its output, the CLIs exit 1 when a signal kills the driver, and findEdgePath() on Windows returns undefined instead of throwing.
• Root README: spawnOpts rows for edgedriver and safaridriver, NO_PROXY and the lower-case proxy variables, CDN credentials. The package READMEs document the credentials too; edgeDriverVersion no longer links to the retired msedgedriver.azureedge.net.
• Packaging. .npmignore excluded only tsconfig.json, so the 8.0.0 / 3.0.0 tarballs would ship tsconfig.test.json. scripts/check-pack.mjs now also fails on any file outside an allow-list (LICENSE, README.md, AUTHORS, package.json, bin/*.js, dist/**).
• Docs gaps: EDGE_BINARY_PATH in the root README, the geckodriver_cdnurl .npmrc key in the geckodriver README, and % is %25 in the credential notes.

Test plan

• New tests against a local CDN at http://user:p%40ss@127.0.0.1:…: edgedriver (404 on .91 → LATEST_RELEASE_120_* → .92 zip) and geckodriver (real .tar.gz). Red on main with the fetch credentials error; green with the fix: every request carries Basic base64(user:p@ss) and no log call contains the credentials
• extractBasicAuthFromUrl unit tests for geckodriver (run on every OS, so Windows keeps its branch coverage above the threshold)
• extractBasicAuthFromUrl with us%er:p%ss in both packages: red before the fix (the URL came back with the credentials), green after
• check-pack.mjs red on the 3 packages with tsconfig.test.json, green after the .npmignore change
• Build, lint, unit with type-check and coverage, check:pack, full e2e (12); credential tests on Node 22.19.0

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the previous password-log issue is fixed.

Summary

This PR fixes authenticated CDN requests and fills gaps in the upgrade notes.

• Driver downloads can use credentials from custom CDN URLs.
• Driver setup docs explain CDN credentials, proxy settings, and v8 changes.
• Package checks flag files outside the expected tarball list.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Configured CDN URL] --> B[Extract credentials]
  B --> C[Decode credentials or keep invalid encoding as text]
  C --> D[Build Basic Authorization header]
  B --> E[Remove credentials from URL]
  E --> F[Log cleaned URL]
  E --> G[Request CDN]
  D --> G

Loading

_{Reviews (2) · Last reviewed commit: "docs: document EDGE_BINARY_PATH, the gec..." · Reviewed by Greptile}