# Password for proxies from external

2 messages from 2021-11-12 to 2021-11-12. Participants: 6a50120e@schuerz.at, Jeff King.
Thread: https://gitlist.dev/t/56879

## 6a50120e@schuerz.at, 2021-11-12 13:07

Subject: Password for proxies from external
Message-ID: <5743c211-bf8b-b485-3b81-a71b1b64bb4d@schuerz.at>
URL: https://gitlist.dev/e/5743c211-bf8b-b485-3b81-a71b1b64bb4d%40schuerz.at

```
Hi there!

If searched a lot and everywhere i found the same information...

when i want to set a http-proxy for git, the configuration goes to 
~/.gitconfig

ˋˋˋ
[http]
     proxy = http://username:password@proxy.dings.bums:1234

ˋˋˋ

So the proxy password is in cleartext written down to the config-file. 
The git own password-store can not be used... even no external like pass.


For aliases i can set something like
ˋˋˋ
[alias]
     blafoo = "!f() {do something on shell}; f"
ˋˋˋ

But this does not work for proxy-settings.

There should be a mechanism to read a password or the credentials from 
the shell in proxy-settings. Something like bash-subshell-construct.

ˋˋˋ
[http]
     proxy = http://$(pass show key|grep login):$(pass show key|head 
-n1)@proxy.dings.bums:1234
ˋˋˋ

or

ˋˋˋ
[http]
     proxy = "!u() {pass show key|grep login}; !p() {pass show key|head 
-n1}; http://u:p@proxy.dings.bums:1234"
ˋˋˋ

This would close the security-hole of cleartext-credentials in 
config-files...

thank you

Jakob

-- 


```

## Jeff King, 2021-11-12 21:28

Subject: Re: Password for proxies from external
Message-ID: <YY7cdTC2HWOoe56z@coredump.intra.peff.net>
URL: https://gitlist.dev/e/YY7cdTC2HWOoe56z%40coredump.intra.peff.net
In-Reply-To: <5743c211-bf8b-b485-3b81-a71b1b64bb4d@schuerz.at>

```
On Fri, Nov 12, 2021 at 02:07:03PM +0100, 6a50120e@schuerz.at wrote:

> when i want to set a http-proxy for git, the configuration goes to
> ~/.gitconfig
> 
> ˋˋˋ
> [http]
>     proxy = http://username:password@proxy.dings.bums:1234
> 
> ˋˋˋ
> 
> So the proxy password is in cleartext written down to the config-file. The
> git own password-store can not be used... even no external like pass.

Have you tried including just the username, like:

  [http]
  proxy = http://username@example.com:1234

That should prompt for the password, including using your regular
configured credential helpers; see 372370f167 (http: use credential API
to handle proxy authentication, 2016-01-26).

We don't recognize HTTP 407 ("Proxy Authentication Required") to trigger
the username/password lookup, like we do for an HTTP 401. That probably
wouldn't be much code to add, but I suspect it's less important for a
proxy versus a regular site because you only use one proxy (and it
either needs auth or it doesn't).

-Peff

```