Re: git-http-backend: anonymous read, authenticated write

From: Jakub Narębski <jnareb@gmail.com>
Date: Apr 10, 2013, 21:30 UTC
Message-ID: <5165DA13.8010100@gmail.com>
In-Reply-To: <20130409171247.GD21972@sigill.intra.peff.net>

Jeff King wrote:

> On Tue, Apr 09, 2013 at 07:45:53AM +0200, Magnus Therning wrote:

>>     % git push 
>>     error: The requested URL returned error: 403 Forbidden while accessing
>>

http://magnus@tracsrv.local/git/foo.git/info/refs?service=git-receive-pack

Show 10 quoted lines

> 
> Something in your config is blocking access to info/refs there. It
> should not be the block shown above, which handles only the actual POST
> of the data. The sequence of http requests made is:
> 
>   1. GET $repo/info/refs?service=git-receive-pack
> 
>      This makes initial contact and gets the ref information which push
>      uses to decide what it is going to push. So it is read-only, and in
>      an anonymous-read setup, does not need to be protected.

Yes, it doesn't need to be protected, but *git-receive-pack* requires (or required) valid user even for above GET request for getting refs.

Show 9 quoted lines

>   2. POST $repo/git-receive-pack
> 
>      This actually pushes up the objects and updates the refs, and
>      must be protected.
> 
> The setup listed above does work with apache; it is tested as part of
> our test suite (you can see the actual config in t/lib-httpd/apache.conf).
> So what in lighttpd is giving us the 403? Can you share your whole
> config?

I think I have seen a patch on git mailing list to correct this, but I am not sure.

Are you sure that we test this correctly?

-- 
Jakub Narębski