Re: [PATCH] http: Support sending custom HTTP headers

From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Apr 26, 2016, 15:33 UTC
Message-ID: <alpine.DEB.2.20.1604260851390.2896@virtualbox>
In-Reply-To: <xmqq7fflleau.fsf@gitster.mtv.corp.google.com>

Hi Junio,

On Mon, 25 Apr 2016, Junio C Hamano wrote:

Show 11 quoted lines

> Johannes Schindelin <johannes.schindelin@gmx.de> writes:
> 
> > To make communication for `git fetch`, `git ls-remote` and friends
> > extra secure, we introduce a way to send custom HTTP headers with all
> > requests.
> 
> I think an ability to send custom headers may be a good addition and
> have no problem with it, but I tend to agree with Shawn that its log
> message that advertises it as if it has anything to do with security is
> probably a bad idea in both ways (i.e. it isn't very secure, and the
> usefulness of the feature is not limited to security).

You know, it never occurred to me that anybody could even *think* that I was talking about the security of the client setup.

You see, it is much easier to read $HOME/.netrc than /proc/, especially if you are looking outside of Linux, where the proc filesystem does not even exist. And it is almost as easy to query the credential helper for a plain text password as looking at $HOME/.netrc.

So I took it for granted that everybody knows that they have to keep their own computer safe.

Instead, I was thinking of server side security (with the clear expectation that the users will keep their client setups secure).

I will rephrase the commit message to describe the actual use case I have here: build agents need temporary access to private repositories, and I'd like to do that via sort of One-Time-Passwords, sent as additional HTTP headers (via HTTPS, I should not need to point out, but now feel I have to spell out).

> > Published-As: https://github.com/dscho/git/releases/tag/extra-http-headers-v1
> 
> Move this after "---".

Whoops. That is what I intended, but overlooked. Will fix.

> This obviously needs documentation updates and tests, no?

Documentation, yes. I have that already, but somehow it slipped out of the patch.

Testing the headers? I dunno, do we have tests for that already? I thought we did not: it requires an HTTP server (so that the headers are actually sent) that we can force to check the header...

So I see we have some tests that use Apache, and one that uses our own http-backend. But is there already anything that logs HTTP requests? I did not think so, please correct me if I am wrong.

Ciao, Dscho