git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: git-http-backend and Authenticated Pushes

From
ADAntonio García Domínguez <nyoescape@gmail.com>
Date
Mar 9, 2010, 19:23 UTC
Message-ID
<2b8265361003091123g780a9b36g5ec641d465c7df02@mail.gmail.com>
In-Reply-To
<64E1366D-31FC-4E0D-9F7D-35E6387E2EC1@bjhargrave.com>
Hi BJ,
> LocationMatch will not match against the query string which is where the service name is. To match against the query string, you would need to do something like:

Oops, you're right. I'm actually matching the unparsed URL using a regexp in a Perl authentication module, so I missed that Apache detail. Your snippet looks good to me.

> But, I would think using <LimitExcept GET PROPFIND OPTIONS REPORT> to protect against "writing" to the repo without auth should be sufficient.

But that doesn't work for the smart HTTP method. Limiting by method is OK for dumb HTTP (as we're basically just modifying files using WebDAV), but the git-http-backend CGI only uses GET and POST, and requires authentication depending not on the HTTP method, but what service is being used.

Or so I think :-).

Cheers, Antonio

Previous: BJ HargraveNext: Shawn O. Pearce
Message 4 of 6 in “git-http-backend and Authenticated Pushes”
  1. Ryan PhillipsMar 9, 2010
  2. Antonio García DomínguezMar 9, 2010
  3. BJ HargraveMar 9, 2010
  4. Antonio García DomínguezMar 9, 2010
  5. Shawn O. PearceMar 9, 2010
  6. Ryan PhillipsMar 10, 2010

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.