Trying to disable all/any anonymous access, but packages are still available to anonymous users

[ca-wvestjens]

Hi,

I've got the following config enabled:

  packages:
    '@*/*':
      access: $authenticated
      publish: $authenticated
      proxy: ""

    '**':
      access: $authenticated
      publish: $authenticated
      proxy: ""

With this, I expect that access (read?) and publishing (write) is reserved to authenticated users only.

That, to me, means if I open the web interface I should not be seeing these packages. This is actually the case, my published test package is available. In the search (if I go to /-/search?text=package) and through npm search it's not visible.

Any help? Did I misconfigure Verdaccio, is it a bug or is it a feature?

[juanpicado]

Are you sure you are updating the correct config.yaml file ? it happened to me before.

[ca-wvestjens]

Yes, I've verified that inside of the pod, the correct configuration is being applied (installed through Helm)

[juanpicado]

I would try to reproduce the same with a clean installation using npmjs at the end is the same. I don't recall any changes regarding that area.

[ca-wvestjens]

If I understand your reply correctly, web showing the packages even though you should be authenticated is not the expected behavior then?

A semi-acceptable workaround for now is disabling the web interface (it's acceptable; you can search through npm --registry <url> search <term> anyway, however, it's interesting that it shows the packages on web...

[juanpicado]

No, you can test this https://registry.verdaccio.org/ and you can only acccess Verdaccio packages but not others.