# Issue apm agent with backend requests username:password@url

**URL:** <https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903>\
**Category:** APM\
**Tags:** nodejs\
**Created:** [January 11, 2023, 10:24am UTC](https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903 "2023-01-11T10:24:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Klauck](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@Klauck](https://discuss.elastic.co/u/Klauck)\
**Post date:** [January 11, 2023, 10:24am UTC](https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903/1 "2023-01-11T10:24:59Z")

</div>

Hi,

we are making a request to an external service with basic auth in the url e.g. like [https://fooUser:fooPwd@url](https://fooUser:fooPwd@url)

with apm agent not started this works very fine. with apm agent started we are getting an unauth from the external service and apm is logging this external request (in Metadata) the request is logged as [https://url](https://url)

Also managed to pass the credentatials via headers, is this the expected behaviour or an bug?

Best Martin

---

<div class="post-metadata">

**Author:** ![trentm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trentm/32/77647_2.png) [@trentm](https://discuss.elastic.co/u/trentm)\
**Post date:** [January 11, 2023, 4:07pm UTC](https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903/2 "2023-01-11T16:07:10Z")

</div>

@Klauck That definitely sounds like a bug. The APM agent shouldn't be changing the behaviour of your code. My guess is that is comes down to the particular way your code is using the HTTP library you are using. Are you able to provide some details?

- A snippet of code or a small reproduction case that shows how the HTTP request is being made.
- The version of node and of any relevant node packages being used.

---

<div class="post-metadata">

**Author:** ![Klauck](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@Klauck](https://discuss.elastic.co/u/Klauck)\
**Post date:** [January 13, 2023, 7:49am UTC](https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903/3 "2023-01-13T07:49:25Z")

</div>

Thanks Mick,  
I created a quick test and the problem occurs there as well  
If commenting 2. line of server.js, authentication is made successfully  
Cheers

Martin  
Node version v16.13.2  
APM Sever: [docker.elastic.co/apm/apm-server:7.13.1](http://docker.elastic.co/apm/apm-server:7.13.1)

**package.json**

```auto
{
  "scripts": {
    "start": "node server.js"
  },
  "dependencies": {
    "elastic-apm-node": "^3.41.1",
    "express": "4.18.2",
    "got": "11.8.1"
  }
}

```

**server.js** :

```auto
const apm = require("elastic-apm-node");
apm.start({ serviceName: 'test' });
const express = require('express')
const got = require("got");
const app = express()
app.get('/', (req, res) => {
  const apiUrl = 'https://authenticationtest.com/HTTPAuth/'
  const call = got.extend({
    username: 'user',
    password: 'pass',
    prefixUrl: apiUrl,
    retry: { methods: ["GET"], },
  });
  call.get().then(data => {
    // user/password was provided, but maybe wrong (if you change line 10)
    res.send(data.body.includes('Login Failure') ? 'NOK' : 'OK')
  }).catch(error => {
    // user/password was not even provided
    res.send(error.message)
  })
})
app.listen(3000, () => { console.log(`App listening on port 3000`) })

```

---

<div class="post-metadata">

**Author:** ![trentm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trentm/32/77647_2.png) [@trentm](https://discuss.elastic.co/u/trentm)\
**Post date:** [January 14, 2023, 12:30am UTC](https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903/4 "2023-01-14T00:30:03Z")

</div>

@Klauck Thanks very much for the reproduction case!

After finding the bug in the APM agent causing this, I found an issue that I'd already opened a long while back for this: [instrumentation of `http{s}.request()` has a few edge case issues · Issue #2044 · elastic/apm-agent-nodejs · GitHub](https://github.com/elastic/apm-agent-nodejs/issues/2044)

I've created a PR to fix this: [fix: instrumentation of `http|https.request|get` has a few edge cases by trentm · Pull Request #3090 · elastic/apm-agent-nodejs · GitHub](https://github.com/elastic/apm-agent-nodejs/pull/3090)  
I will get that in early next week and get a release out with the fix.

---

<div class="post-metadata">

**Author:** ![Klauck](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@Klauck](https://discuss.elastic.co/u/Klauck)\
**Post date:** [January 16, 2023, 8:44am UTC](https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903/5 "2023-01-16T08:44:19Z")

</div>

Well happy I could contribute a bit.

Many thanks, Mick

---

<div class="post-metadata">

**Author:** ![trentm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trentm/32/77647_2.png) [@trentm](https://discuss.elastic.co/u/trentm)\
**Post date:** [January 18, 2023, 8:27pm UTC](https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903/6 "2023-01-18T20:27:49Z")

</div>

elastic-apm-node@3.42.0 is released with a fix for this now. Thanks, again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2023, 4:28pm UTC](https://discuss.elastic.co/t/issue-apm-agent-with-backend-requests-username-password-url/322903/7 "2023-02-08T16:28:22Z")

</div>

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.