Welcome to the Inedo Forums! Check out the Forums Guide for help getting started.
If you are experiencing any issues with the forum software, please visit the Contact Form on our website and let us know!
Unauthorized access issue in ProGet 3.3.2 (was fine in 3.1.7)
-
Today I've updated to ProGet 3.3.2 (from 3.1.7) and noticed an issue with authentication.
In my configuration I have disabled anonymous access by deleting all privileges for Anonymous User.
The issue is that in version 3.3.2 you can access feed URL (http://localhost:81/nuget/Default) as anonymous without logging in. It was working fine in 3.1.7 version where it was asking for credentials.
To replicate (assuming clean install):
- Remove all privileges for Anonymous User
- Open http://localhost:81/nuget/Default in incognito window (or logout first)
- Issue: Unauthorized user is able to access http://localhost:81/nuget/Default
This is causing issues when trying to download packages from private feeds using NuGet command line tool and Visual Studio plugin.
Product: ProGet
Version: 3.3.2
-
We've reproduced this and implemented a fix- we'll have v3.3.3 available today to resolve this issue. Thanks for the bug report!