Re: Changing transfer.credentialsInUrl to default to "warn"

From: Junio C Hamano <gitster@pobox.com>
Date: Jan 13, 2025, 22:27 UTC
Message-ID: <xmqq34hm8i4b.fsf@gitster.g>
In-Reply-To: <7a60c9ec-8f98-73d3-4539-d96b63a4f442@gmx.de>

Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:

> The reason why `.pushURL` was not handled as well is that it is way too
> common for Git users to call `git clone https://<user>:<password>@<host>`
> ...
> There is no similar indirect way to leak credentials into `pushURL`

Ah, so it is not primarily between .URL vs .pushURL, but the difference is between "clone" that leaves the URL used on the command line in the configuraiton, vs "push" that does not.

And because .pushURL has to be explicitly configured by the end-user, there is much less need to remind that they are _storing_ credential material in the configuration files.

The reasoning does make sense.

> Having said that, I would be in favor of letting
> `transfer.credentialsInURL` treat `remote.*.pushURL` in the same manner as
> `remote.*.url`.

Amen to that.  Thanks.