{"thread":{"id":"62497","subject":"Bug Report","startedAt":"2024-11-15T13:02:41Z","lastAt":"2024-11-15T20:08:31Z","messageCount":2,"participants":["Sachin tiwari","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"507360","messageId":"CAGoMMr+f4oqgDqq_1h4cV39GVRd8fgzEzHgBP8fJsJ+HAgiwqQ@mail.gmail.com","threadId":"62497","inReplyTo":null,"subject":"Bug Report","fromName":"Sachin tiwari","fromEmail":"sjtiwari007@gmail.com","sentAt":"2024-11-15T13:02:21Z","receivedAt":"2024-11-15T13:02:41Z","isPatch":false,"sender":{"key":"sjtiwari007@gmail.com","avatar":null},"body":"Sachin tiwari <sjtiwari007@gmail.com>\n\n18:28 (3 minutes ago)\nto git\nHello,\nTitle:Git Clones Repository Even After Incorrectly Inputting Personal\nAccess Token (PAT) and Leaving Password Blank\n\nDescription:\nWhen cloning a repository using HTTPS, Git prompts for the username\nand password. However, if a Personal Access Token (PAT) is mistakenly\nentered when prompted for a username and the password is left empty,\nthe repository is cloned successfully without any authentication\nfailure. This behavior should not occur, as Git should ideally reject\nthe clone operation when a PAT is input as a username and no password\nis provided.\n\nI hope this will explain enough. For any more information , please let me know.\n\nThanking You\nSachin Tiwari\n"},{"id":"507375","messageId":"ZzeqO9n_6dLBgRmX@tapette.crustytoothpaste.net","threadId":"62497","inReplyTo":"CAGoMMr+f4oqgDqq_1h4cV39GVRd8fgzEzHgBP8fJsJ+HAgiwqQ@mail.gmail.com","subject":"Re: Bug Report","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2024-11-15T20:08:27Z","receivedAt":"2024-11-15T20:08:31Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2024-11-15 at 13:02:21, Sachin tiwari wrote:\n> Sachin tiwari <sjtiwari007@gmail.com>\n> \n> 18:28 (3 minutes ago)\n> to git\n> Hello,\n> Title:Git Clones Repository Even After Incorrectly Inputting Personal\n> Access Token (PAT) and Leaving Password Blank\n> \n> Description:\n> When cloning a repository using HTTPS, Git prompts for the username\n> and password. However, if a Personal Access Token (PAT) is mistakenly\n> entered when prompted for a username and the password is left empty,\n> the repository is cloned successfully without any authentication\n> failure. This behavior should not occur, as Git should ideally reject\n> the clone operation when a PAT is input as a username and no password\n> is provided.\n\nThis isn't a bug.  Git itself has no way of knowing whether what you put\nin a field is a username, password, token, or something else entirely.\nThe decision on authentication is made by the remote system, and it can\napply arbitrary policies on what to accept and what not to.\n\nMy guess is that you're using GitHub, and GitHub allows you to do this.\nGitHub requires that you use a token, and it can be in the username or\npassword field, mostly for backwards compatibility (changing it now\nwould break a lot of things and isn't really possible).\n\nI would say that it's definitely strongly recommended to not put secrets\nin the username, because many tools will filter passwords from logs, but\nthe username is often not filtered, so you _should not_ do this, but\nwith GitHub, you can indeed do it if you really want.\n-- \nbrian m. carlson (they/them or he/him)\nToronto, Ontario, CA\n"}]}