Introduction
After updating Artifactory to version 7.98, installing npm scoped packages may result in 400 errors. This article will discuss the reason for this issue and how to fix it.
Root Cause
NPM scoped packages are generally in the form of <scope>/<package>.
By default, the npm client encodes slash characters (/) to their ASCII representation (%2f) before communicating with the npm registry. If you are running Tomcat as your HTTP container (the default for Artifactory), this generates an HTTP 400 error since Tomcat does not allow encoded slashes by default.
Due to this, you should add the following parameter to the Tomcat server.xml configuration (in Artifactory version lower than 7.98):
org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true
See further details in our documentation.
The upgrade of Artifactory to version 7.98 has also resulted in an upgrade of the embedded Tomcat server to version 10.x (See embedded tomcat versions in Artifactory).
In this version, org.apache.tomcat.util.buf.UDecoder.Allow_Encoded_Slash was replaced with the connector encodedSolidusHandling (See Tomacat Changelog).
This change was not reflected in the server.xml config of the Artifacotry and Access , causing npm scoped packages installation to return the aforementioned error.
Resolution
Adding the new parameter to the server.xml configured in Artifactory will resolve the issue. This can be done via the system.yaml:
artifactory:
tomcat:
connector:
extraConfig: "encodedSolidusHandling='DECODE'"
access:
tomcat:
connector:
extraConfig: "encodedSolidusHandling='DECODE'"
And restart Artifactory to apply the changes.
The extra configuration was added by default from Artifactory version 7.98.9 (reference: INST-9289 in our release notes)