From: Jeff King <peff@peff.net>
To: 乙酸鋰 <ch3cooli@gmail.com>
Cc: "Shawn O. Pearce" <spearce@spearce.org>, git@vger.kernel.org
Subject: Re: git smart-http do not authent to allow git ls-remote to be called anonymously
Date: Sun, 30 Sep 2012 21:09:35 -0400 [thread overview]
Message-ID: <20121001010935.GA18987@sigill.intra.peff.net> (raw)
In-Reply-To: <CAHtLG6Q+XO=LhnKw4hhwtOe2ROeDN1Kg=JN5GTQqdvYjk-Sv4g@mail.gmail.com>
On Sun, Sep 30, 2012 at 10:35:35PM +0800, 乙酸鋰 wrote:
> I use smart-http on Apache.
> If nothing to be pushed / pulled, I do not want password to be
> supplied. And allow git ls-remote to run without password
>
> *.git/info/refs?service=git-upload-pack
> *.git/info/refs?service=git-receive-pack
>
> I only need authentication on
>
> *.git/git-upload-pack
> *.git/git-receive-pack
>
> /etc/apache/httpd.conf
>
> <LocationMatch "^/git/.*/git-(upload|receive)-pack$">
> AuthType Basic
> AuthName "staff only"
> AuthUserFile /etc/apache/apache.pwd
> Require valid-user
> </LocationMatch>
>
> However this does not work. It does not ask for password at all.
What is "it" in the final sentence? Does the server not tell the git
client that authorization is required, and actually serve the request?
If so, then that is a bug in your apache config.
Or is it that the server tells git that it needs authorization, but git
does not prompt, and instead just fails with "Authentication failed". In
that case, the issue is that you need a newer git client. Traditionally
the client expected to handle authentication during the initial
"info/refs" request. I added support for handling authentication during
later requests in commit b81401c, which is in git v1.7.11.7 and
v1.7.12.1.
You should reconsider whether this is what you really want, though. With
the configuration you showed, anyone will be able to get a list of all
refs and their sha1s. So they would know all your branch names, and they
could even potentially find out what's in your branches by making
offline guesses and comparing them to your branch sha1s (the feasibility
of this would depend on exactly what you're storing).
-Peff
next prev parent reply other threads:[~2012-10-01 1:09 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-30 14:35 git smart-http do not authent to allow git ls-remote to be called anonymously 乙酸鋰
2012-10-01 0:53 ` Shawn Pearce
2012-10-01 1:09 ` Jeff King [this message]
[not found] ` <CAHtLG6QFu1rOfUeWREwVG540WvXtM1SnH6aHEJ9dKLzwNxbkVg@mail.gmail.com>
[not found] ` <CAHtLG6T=hFsSy=ScRK2cYBoUcmAG_tsg12FiFMTvzpHGmPTzfg@mail.gmail.com>
2012-10-14 6:30 ` Jeff King
[not found] ` <CAHtLG6QR4CtC3RkVE3FQXhrZPJem6SZbrJFyn9K_4yHzhzYt1Q@mail.gmail.com>
[not found] ` <20121026134907.GK1455@sigill.intra.peff.net>
[not found] ` <CAHtLG6SsMgwquaD_Rd0YvR9Ues-u1ktEdOXC2MAfEM9Naac=5g@mail.gmail.com>
2012-10-31 11:53 ` Jeff King
2012-10-31 11:55 ` [PATCH 1/2] remote-curl: hoist gzip buffer size to top of post_rpc Jeff King
2012-10-31 12:01 ` [PATCH 2/2] remote-curl: retry failed requests for auth even with gzip Jeff King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121001010935.GA18987@sigill.intra.peff.net \
--to=peff@peff.net \
--cc=ch3cooli@gmail.com \
--cc=git@vger.kernel.org \
--cc=spearce@spearce.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).