Yarn: authorisation headers added when url contains '@' (e.g, scoped package)

[rparree]

An athentication header is added to the request when there is an at-sign in the url. Scoped packages use an at-sign.

This resolves to true:

this.getScopedOption(registry.replace(/^https?:/, ''), 'always-auth') || this.getOption('always-auth')
      || removePrefix(requestUrl, registry)[0] === '@';

https://github.com/yarnpkg/yarn/blob/b4e42e3e73a3d714fd44cc0d3968cf33e43a03c7/src/registries/npm-registry.js#L56

[rparree]

Is the idea of:

removePrefix(requestUrl, registry)[0] === '@';

to check for a username[:password]@ in the url?

EDIT: It was added in 50aae7d

[rparree]

Work around for now i just removed my _auth configuration (so it adds an empty string to the authorisation header.