Proxied packages still need auth?

[bfontaine]

Hello,
I use Verdaccio 6.1.6 with Docker and this config:

uplinks:
  npmjs:
    url: https://registry.npmjs.org/

packages:
  '@mycompany/*':
    access: $all
    publish: $all
    unpublish: $all

  '*':
    proxy: npmjs

log: {type: stdout, format: pretty, level: debug}

It runs on a VPN, so I allow everyone to publish everything under @mycompany/ on the private registry without any auth, and proxy everything else to the standard npm registry.

However this didn’t work:

$ curl -I https://registry.npmjs.org/string-width
HTTP/2 200
...

$ curl -I https://myregistry.example.xx/string-width
HTTP/2 401
...

Turns out that I needed to add an access directive for the proxy:

  '*':
    proxy: npmjs
    access: $all  # <------

However this is not documented; the default config doesn’t have an access directive for the proxy. Is this a bug?

My Dockerfile:

FROM verdaccio/verdaccio:6.1.6
ADD config.yaml /verdaccio/conf/config.yaml
ADD htpasswd /verdaccio/conf/htpasswd  # empty file

ENV DEBUG=verdaccio*

The server logs:

2025-08-26T09:10:49.584228569Z app[web.1]: info <-- 172.17.0.1 requested 'GET /string-width'
2025-08-26T09:10:49.584399790Z app[web.1]: http <-- 401, user: null(<redacted> via 172.17.0.1), req: 'GET /string-width', error: authorization required to access package string-width
2025-08-26T09:10:49.584542510Z app[web.1]: http <-- 401, user: null(<redacted> via 172.17.0.1), req: 'GET /string-width', error: authorization required to access package string-width

[mbtools]

Thanks for the feedback. The default config is correct, but the documentation is out of date. I updated the docs #5371