From ee5be03ae09ce9c57b8997d55d8ce4639c029c3a Mon Sep 17 00:00:00 2001
From: Shubham Padkonde <shubhampadkonde12@gmail.com>
Date: Thu, 1 Oct 2026 22:42:58 +0530
Subject: [PATCH] fix: send empty-string HTTP Basic credentials

---
 lib/winston/transports/http.js            |  3 ++-
 test/unit/winston/transports/http.test.js | 32 +++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/lib/winston/transports/http.js b/lib/winston/transports/http.js
index 17f661af4..14f5c2a9e 100644
--- a/lib/winston/transports/http.js
+++ b/lib/winston/transports/http.js
@@ -246,7 +246,8 @@ module.exports = class Http extends TransportStream {
       port: this.port,
       path: `/${path.replace(/^\//, '')}`,
       headers: headers,
-      auth: (auth && auth.username && auth.password) ? (`${auth.username}:${auth.password}`) : '',
+      auth: (auth && typeof auth.username === 'string' && typeof auth.password === 'string')
+        ? `${auth.username}:${auth.password}` : '',
       agent: this.agent
     });
 
diff --git a/test/unit/winston/transports/http.test.js b/test/unit/winston/transports/http.test.js
index 02fd1a367..549fcde71 100644
--- a/test/unit/winston/transports/http.test.js
+++ b/test/unit/winston/transports/http.test.js
@@ -59,6 +59,38 @@ describe('Http({ host, port, path })', function () {
     server.close(done.bind(null, null));
   });
 
+  describe('basic authentication', function () {
+    [
+      { username: 'user', password: '' },
+      { username: '', password: 'token' },
+      { username: '', password: '' },
+      { username: 'user', password: 'secret' }
+    ].forEach(function (auth) {
+      it(`sends credentials ${JSON.stringify(auth)}`, function (done) {
+        let authorization;
+        server = http.createServer(function (req, res) {
+          authorization = req.headers.authorization;
+          req.resume();
+          res.end();
+        });
+        server.listen(port, host, function () {
+          const transport = new Http({ host, port: server.address().port, auth });
+          transport.on('warn', done);
+          transport.on('logged', function () {
+            try {
+              const encoded = Buffer.from(`${auth.username}:${auth.password}`).toString('base64');
+              assume(authorization).equals(`Basic ${encoded}`);
+              done();
+            } catch (err) {
+              done(err);
+            }
+          });
+          transport.log(dummyLog);
+        });
+      });
+    });
+  });
+
   describe('nominal', function () {
 
     beforeEach(function (done) {