# Bug Report 2 messages from 2024-11-15 to 2024-11-15. Participants: Sachin tiwari, brian m. carlson. Thread: https://gitlist.dev/t/62497 ## Sachin tiwari, 2024-11-15 13:02 Subject: Bug Report Message-ID: URL: https://gitlist.dev/e/CAGoMMr%2Bf4oqgDqq_1h4cV39GVRd8fgzEzHgBP8fJsJ%2BHAgiwqQ%40mail.gmail.com ``` Sachin tiwari 18:28 (3 minutes ago) to git Hello, Title:Git Clones Repository Even After Incorrectly Inputting Personal Access Token (PAT) and Leaving Password Blank Description: When cloning a repository using HTTPS, Git prompts for the username and password. However, if a Personal Access Token (PAT) is mistakenly entered when prompted for a username and the password is left empty, the repository is cloned successfully without any authentication failure. This behavior should not occur, as Git should ideally reject the clone operation when a PAT is input as a username and no password is provided. I hope this will explain enough. For any more information , please let me know. Thanking You Sachin Tiwari ``` ## brian m. carlson, 2024-11-15 20:08 Subject: Re: Bug Report Message-ID: URL: https://gitlist.dev/e/ZzeqO9n_6dLBgRmX%40tapette.crustytoothpaste.net In-Reply-To: ``` On 2024-11-15 at 13:02:21, Sachin tiwari wrote: > Sachin tiwari > > 18:28 (3 minutes ago) > to git > Hello, > Title:Git Clones Repository Even After Incorrectly Inputting Personal > Access Token (PAT) and Leaving Password Blank > > Description: > When cloning a repository using HTTPS, Git prompts for the username > and password. However, if a Personal Access Token (PAT) is mistakenly > entered when prompted for a username and the password is left empty, > the repository is cloned successfully without any authentication > failure. This behavior should not occur, as Git should ideally reject > the clone operation when a PAT is input as a username and no password > is provided. This isn't a bug. Git itself has no way of knowing whether what you put in a field is a username, password, token, or something else entirely. The decision on authentication is made by the remote system, and it can apply arbitrary policies on what to accept and what not to. My guess is that you're using GitHub, and GitHub allows you to do this. GitHub requires that you use a token, and it can be in the username or password field, mostly for backwards compatibility (changing it now would break a lot of things and isn't really possible). I would say that it's definitely strongly recommended to not put secrets in the username, because many tools will filter passwords from logs, but the username is often not filtered, so you _should not_ do this, but with GitHub, you can indeed do it if you really want. -- brian m. carlson (they/them or he/him) Toronto, Ontario, CA ```