git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Implementing authenticated Smart HTTP - which URLs to secure

From
JHJonas H. <jonas@lophus.org>
Date
Jul 15, 2012, 13:43 UTC
Message-ID
<5002C8F3.6080400@lophus.org>
Howdy!

I'd like to implement HTTP authentication for Git Smart HTTP using Dulwich (a Python binding):

1) read-only if unauthenticated and write only if authenticated
2) read/write only if authenticated

I couldn't find any documentation on which URLs need be secured and what response codes are expected in case the cloner/pusher is unauthenticated.

Is there any documentation on Smart HTTP workflow? The C sources (vanilla Git and libgit2) didn't help me too much since I found it very difficult to follow the code-flow... it's probably just abstracted too well :-)

Thanks! Jonas

Next: Shawn Pearce
Message 1 of 3 in “Implementing authenticated Smart HTTP - which URLs to secure”
  1. Jonas H.Jul 15, 2012
  2. Shawn PearceJul 15, 2012
  3. Jonas H.Jul 16, 2012

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.