From 62ff082deb41e711ae29c9e09ce173eef04390d6 Mon Sep 17 00:00:00 2001
From: Vsevolod Strukchinsky <floatdrop@gmail.com>
Date: Wed, 14 Oct 2015 21:47:48 +0500
Subject: [PATCH] Throw on authentication in url string

Closes #106
---
 index.js          | 10 +++++++++-
 test/arguments.js |  7 +++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/index.js b/index.js
index 6bcf4b8..c850a75 100644
--- a/index.js
+++ b/index.js
@@ -182,9 +182,17 @@ function normalizeArguments(url, opts) {
 		throw new Error('Parameter `url` must be a string or object, not ' + typeof url);
 	}
 
+	if (typeof url === 'string') {
+		url = urlLib.parse(prependHttp(url));
+
+		if (url.auth) {
+			throw new Error('Basic authentication must be done with auth option');
+		}
+	}
+
 	opts = objectAssign(
 		{protocol: 'http:', path: ''},
-		typeof url === 'string' ? urlLib.parse(prependHttp(url)) : url,
+		url,
 		opts
 	);
 
diff --git a/test/arguments.js b/test/arguments.js
index cad270a..7d78121 100644
--- a/test/arguments.js
+++ b/test/arguments.js
@@ -52,6 +52,13 @@ test('arguments - overrides querystring from opts', t => {
 	});
 });
 
+test('arguments - should throw with auth in url', t => {
+	t.throws(() => {
+		got(`https://test:45d3ps453@account.myservice.com/api/token`, () => {});
+	}, /Basic authentication must be done with auth option/);
+	t.end();
+});
+
 test.after('arguments - cleanup', t => {
 	s.close();
 	t.end();