From: Matthew John Cheetham Date: Tue, 28 Apr 2026 14:38:17 GMT Subject: Re: [PATCH 2/3] http: attempt Negotiate auth in http.emptyAuth=auto mode Message-ID: In-Reply-To: On 2026-04-16 17:40, Junio C Hamano wrote: >> The true and false modes are unchanged: true sends empty credentials >> on the very first request (before any 401), and false never sends >> them. > > OK. This is a tangent, but "git config --help" on "http.emptyAuth" > is horrible. It does not say what the allowed values are, so I had > to first write "There are million other things in the system that > this patch does not modify, so what's the point of singling out > these two settings and saying that this patch does not change > them?", before realizing that 'auto' the patch (and the explanation > of the "empty-autho auto-detction" above) is about the third > possiblity of the same variable and take it back. Agreed - the existing description is pretty opaque about what values it actually takes. Should I add another patch to this series to spell out the three values explicitly? How about something like this: http.emptyAuth:: Attempt authentication without seeking a username or password. This can be used to attempt GSS-Negotiate authentication without specifying a username in the URL, as libcurl normally requires a username for authentication. Possible values are: + -- * `auto` (default) - Send empty credentials only if the server's 401 response advertises an authentication mechanism that requires them (such as GSS-Negotiate); otherwise fall back to prompting via the credential helper. * `true` - Always send empty credentials on the very first request, before receiving any 401 response from the server. * `false` - Never send empty credentials. Mechanisms that require empty credentials, such as GSS-Negotiate, will not work. -- Does that read better? Thanks, Matthew