Re: transfer.credentialsInUrl should warn about personal access tokens in user field #leftoverbits
- From
M Hickford <mirth.hickford@gmail.com>
- Date
- Jan 18, 2025, 20:33 UTC
- Message-ID
- <77741bb3-be37-4e63-9bf8-0cbeac50ae24@gmail.com>
- In-Reply-To
- <Z4GZ0oiZCC2Wl3bN@tapette.crustytoothpaste.net>
On 2025-01-10 22:06, brian m. carlson wrote:
> No, this is Basic auth. It's just that GitHub will look at either the > username or password field for the token.
Thanks Brian and Junio for the discussion. I understand your aversion to introducing GitHub-specific PAT detection logic.
The better solution would be for GitHub to stop accepting PAT in the username field. Hopefully that will happen one day. It's undocumented, so its usage ought to diminish.
To speed that along, I've edited the offending StackOverflow answer https://stackoverflow.com/a/70320541/284795