Re: git clone over http with basic auth bug?

From: Paul J R <me@pjr.cc>
Date: Sep 22, 2012, 20:43 UTC
Message-ID: <505E22EC.1060208@pjr.cc>
In-Reply-To: <20120922050935.GA4542@sigill.intra.peff.net>

Indeed, thats correct, i should have tried a newer version really before i posted cause i do pull the main git repo and it would have been relatively easy.

Newer version did indeed fix the problem.

It hadnt occured to me that git-http-backend behaves differently to the "dumb" http protocol on read (though that was from reading the git source so i obviously missed what was going on there). Ultimately im writing a little webapp that wraps around git-http-backend for some git repository management and on reads i've been just "acting like webserver" but on writes i throw off to git-http-backend. But seeing it do authenticated reads properly via git-http-backend im going to change how it functions, cause that does work with older clients.

Thanks!

On 22/09/12 15:09, Jeff King wrote:

Show 28 quoted lines

> On Sat, Sep 22, 2012 at 09:37:38AM +1000, Paul J R wrote:
>
>> Im not sure if this is a bug, or just "as implemented". But when
>> cloning from a repo sitting on a web site that uses basic auth, the
>> git client appears to forget its authentication info and ignores the
>> 401's the server is sending back. It appears to initially login and
>> get refs and HEAD ok, but after that it never authenticates again.
>> Using a .netrc file this will work (or a url of the form
>> http://user:pass@host though http://user@host wont), but i'm curious
>> if theres a way of doing this without having to expose the password
>> in some way?
>>
>> Im using git 1.7.9.5 and when i clone i get the following:
>> [...]
>  From your logs, it looks like you are using the "dumb" http protocol
> (wherein the server does not have to understand git at all). In this
> protocol, we end up making multiple simultaneous requests for objects
> with different curl handles. We had a bug where not all handles are told
> about the credential (but it doesn't always happen; it depends on the
> exact pattern of requests).
>
> This was fixed by dfa1725 (fix http auth with multiple curl handles,
> 2012-04-10), which is in git v1.7.10.2 and higher.
>
> Can you try upgrading to see if that fixes your problem?
>
> -Peff
>