jfrog npm artifactory allows fetch node packages without credentials. is this expected behavior?

Question

I have not set any jfrog credential in.npmrc still allowing me to pull npm packages from npm artifactory.

Just added registry in npm config.

npm config set registry https://artifcts.jfrog.io/artifactory/api/composer/npm-release-virtual

Answer 1

It depends on the Artifactory settings (Administration -> User Management -> Settings -> Allow Anonymous Access). If it is enabled then npm will install the packages or else give 401 if disabled. Hence, it is an expected behavior if Anonymous Access is enabled on Artifactory. You can also refer to the below documentation for more details.

https://www.jfrog.com/confluence/display/JFROG/npm+Registry#npmRegistry-WorkingwithArtifactorywithoutAnonymousAccess