{"thread":{"id":"31623","subject":"git clone over http with basic auth bug?","startedAt":"2012-09-21T23:37:38Z","lastAt":"2012-09-23T17:21:55Z","messageCount":4,"participants":["Paul J R","Jeff King","Shawn Pearce"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"199713","messageId":"505CFA42.9090504@pjr.cc","threadId":"31623","inReplyTo":null,"subject":"git clone over http with basic auth bug?","fromName":"Paul J R","fromEmail":"me@pjr.cc","sentAt":"2012-09-21T23:37:38Z","receivedAt":"2012-09-21T23:37:38Z","isPatch":false,"sender":{"key":"me@pjr.cc","avatar":null},"body":"Hi All,\n\nIm not sure if this is a bug, or just \"as implemented\". But when cloning \nfrom a repo sitting on a web site that uses basic auth, the git client \nappears to forget its authentication info and ignores the 401's the \nserver is sending back. It appears to initially login and get refs and \nHEAD ok, but after that it never authenticates again. Using a .netrc \nfile this will work (or a url of the form http://user:pass@host though \nhttp://user@host wont), but i'm curious if theres a way of doing this \nwithout having to expose the password in some way?\n\nIm using git 1.7.9.5 and when i clone i get the following:\n\n$ git clone http://host/gitrepo/repo.git/\nCloning into 'repo'...\nUsername for 'http://host': user\nPassword for 'http://user@host':\nerror: The requested URL returned error: 401 (curl_result = 22, \nhttp_code = 401, sha1 = f7748ec924c30b4472132dabcf318d3c420a1a15)\nerror: Unable to find f7748ec924c30b4472132dabcf318d3c420a1a15 under \nhttp://host/gitrepo/repo.git\nCannot obtain needed commit f7748ec924c30b4472132dabcf318d3c420a1a15\nwhile processing commit 1283f0d8043b7aafc4edd1c4627d465a92355a49.\nerror: Fetch failed.\n\nAnd on the server side, the logs show:\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/info/refs?service=git-upload-pack HTTP/1.1\" 401 708 \n\"-\" \"git/1.7.9.5\"\nx.x.x.x - user [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/info/refs?service=git-upload-pack HTTP/1.1\" 200 406 \n\"-\" \"git/1.7.9.5\"\nx.x.x.x - user [22/Sep/2012:09:03:21 +1000] \"GET /gitrepo/repo.git/HEAD \nHTTP/1.1\" 200 233 \"-\" \"git/1.7.9.5\"\nx.x.x.x - user [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/12/83f0d8043b7aafc4edd1c4627d465a92355a49 \nHTTP/1.1\" 200 415 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/f7/748ec924c30b4472132dabcf318d3c420a1a15 \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - user [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/c1/2f6404116fba31590dccad46b9dbb35de615a9 \nHTTP/1.1\" 200 505 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/f7/fc6c45d465000483425bfe5f8d52e561b5e376 \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/16/2cac064671b4058eab103d697c15f98da14d54 \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/af/63ba2c594c08f17d1114c1c1cdc6f48d561e59 \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/7e/2300a52c3dc9ecad58226c4f78f9d091e85a00 \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/c0/312c337c661aecf299a4a4f5378b1809bd2c44 \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/97/3e5550bd73275eea820a40067f9da5853c6e5d \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/info/packs HTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/00/6b5267c3b2f11136aedd8b4698e4c22e6c341c \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/55/a5ba763c58c6fa196b97fa5f637198f8e56c07 \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/66/86a522a4f1d2fb93da34c676de85867fb3ab96 \nHTTP/1.1\" 401 708 \"-\" \"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/info/http-alternates HTTP/1.1\" 401 708 \"-\" \n\"git/1.7.9.5\"\nx.x.x.x - - [22/Sep/2012:09:03:21 +1000] \"GET \n/gitrepo/repo.git/objects/info/alternates HTTP/1.1\" 401 708 \"-\" \n\"git/1.7.9.5\"\n"},{"id":"199728","messageId":"20120922050935.GA4542@sigill.intra.peff.net","threadId":"31623","inReplyTo":"505CFA42.9090504@pjr.cc","subject":"Re: git clone over http with basic auth bug?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2012-09-22T05:09:35Z","receivedAt":"2012-09-22T05:09:35Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Sat, Sep 22, 2012 at 09:37:38AM +1000, Paul J R wrote:\n\n> Im not sure if this is a bug, or just \"as implemented\". But when\n> cloning from a repo sitting on a web site that uses basic auth, the\n> git client appears to forget its authentication info and ignores the\n> 401's the server is sending back. It appears to initially login and\n> get refs and HEAD ok, but after that it never authenticates again.\n> Using a .netrc file this will work (or a url of the form\n> http://user:pass@host though http://user@host wont), but i'm curious\n> if theres a way of doing this without having to expose the password\n> in some way?\n> \n> Im using git 1.7.9.5 and when i clone i get the following:\n> [...]\n\n>From your logs, it looks like you are using the \"dumb\" http protocol\n(wherein the server does not have to understand git at all). In this\nprotocol, we end up making multiple simultaneous requests for objects\nwith different curl handles. We had a bug where not all handles are told\nabout the credential (but it doesn't always happen; it depends on the\nexact pattern of requests).\n\nThis was fixed by dfa1725 (fix http auth with multiple curl handles,\n2012-04-10), which is in git v1.7.10.2 and higher.\n\nCan you try upgrading to see if that fixes your problem?\n\n-Peff\n"},{"id":"199748","messageId":"505E22EC.1060208@pjr.cc","threadId":"31623","inReplyTo":"20120922050935.GA4542@sigill.intra.peff.net","subject":"Re: git clone over http with basic auth bug?","fromName":"Paul J R","fromEmail":"me@pjr.cc","sentAt":"2012-09-22T20:43:24Z","receivedAt":"2012-09-22T20:43:24Z","isPatch":false,"sender":{"key":"me@pjr.cc","avatar":null},"body":"Indeed, thats correct, i should have tried a newer version really before \ni posted cause i do pull the main git repo and it would have been \nrelatively easy.\n\nNewer version did indeed fix the problem.\n\nIt hadnt occured to me that git-http-backend behaves differently to the \n\"dumb\" http protocol on read (though that was from reading the git \nsource so i obviously missed what was going on there). Ultimately im \nwriting a little webapp that wraps around git-http-backend for some git \nrepository management and on reads i've been just \"acting like \nwebserver\" but on writes i throw off to git-http-backend. But seeing it \ndo authenticated reads properly via git-http-backend im going to change \nhow it functions, cause that does work with older clients.\n\nThanks!\n\nOn 22/09/12 15:09, Jeff King wrote:\n> On Sat, Sep 22, 2012 at 09:37:38AM +1000, Paul J R wrote:\n>\n>> Im not sure if this is a bug, or just \"as implemented\". But when\n>> cloning from a repo sitting on a web site that uses basic auth, the\n>> git client appears to forget its authentication info and ignores the\n>> 401's the server is sending back. It appears to initially login and\n>> get refs and HEAD ok, but after that it never authenticates again.\n>> Using a .netrc file this will work (or a url of the form\n>> http://user:pass@host though http://user@host wont), but i'm curious\n>> if theres a way of doing this without having to expose the password\n>> in some way?\n>>\n>> Im using git 1.7.9.5 and when i clone i get the following:\n>> [...]\n>  From your logs, it looks like you are using the \"dumb\" http protocol\n> (wherein the server does not have to understand git at all). In this\n> protocol, we end up making multiple simultaneous requests for objects\n> with different curl handles. We had a bug where not all handles are told\n> about the credential (but it doesn't always happen; it depends on the\n> exact pattern of requests).\n>\n> This was fixed by dfa1725 (fix http auth with multiple curl handles,\n> 2012-04-10), which is in git v1.7.10.2 and higher.\n>\n> Can you try upgrading to see if that fixes your problem?\n>\n> -Peff\n>\n"},{"id":"199778","messageId":"CAJo=hJt7d_qzR_RP-Fu=h1iMD-jOgAvgXqGwGX2JQrMHA0+jYQ@mail.gmail.com","threadId":"31623","inReplyTo":"505E22EC.1060208@pjr.cc","subject":"Re: git clone over http with basic auth bug?","fromName":"Shawn Pearce","fromEmail":"spearce@spearce.org","sentAt":"2012-09-23T17:21:55Z","receivedAt":"2012-09-23T17:21:55Z","isPatch":false,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"On Sat, Sep 22, 2012 at 1:43 PM, Paul J R <me@pjr.cc> wrote:\n> It hadnt occured to me that git-http-backend behaves differently to the\n> \"dumb\" http protocol on read (though that was from reading the git source so\n> i obviously missed what was going on there). Ultimately im writing a little\n> webapp that wraps around git-http-backend for some git repository management\n> and on reads i've been just \"acting like webserver\" but on writes i throw\n> off to git-http-backend. But seeing it do authenticated reads properly via\n> git-http-backend im going to change how it functions, cause that does work\n> with older clients.\n\nIt works back as far as 1.6.6 as a client. Clients before 1.6.6 can't\nuse git-http-backend. Fortunately 1.6.6 is pretty old, its nearly 3\nyears ago (Dec 23, 2009).\n"}]}