From: Shawn Pearce <spearce@spearce.org>
Date: Mon, 25 Apr 2016 15:53:01 GMT
Subject: Re: [PATCH] http: Support sending custom HTTP headers
Message-ID: <CAJo=hJucHFFxDeChwWNy7KQ2mbn21WBsJ5eG_S3W4R5z5CGqfg@mail.gmail.com>
In-Reply-To: <abe253758829795c285c2036196ebe7edd9bab34.1461589951.git.johannes.schindelin@gmx.de>

On Mon, Apr 25, 2016 at 6:13 AM, Johannes Schindelin
<johannes.schindelin@gmx.de> wrote:
> To make communication for `git fetch`, `git ls-remote` and friends extra
> secure, we introduce a way to send custom HTTP headers with all
> requests.

Hmm. Its not Apr 1 2016. So I guess you are serious. :)

> This allows us, for example, to send an extra token that the server
> tests for. The server could use this token e.g. to ensure that only
> certain operations or refs are allowed, or allow the token to be used
> only once.
>
> This feature can be used like this:
>
>         git -c http.extraheader='Secret: sssh!' fetch $URL $REF

Its not very secure to be adding secure data to the command line, e.g.
on Linux you can see that data in /proc.