Use personal access tokens as password #3866
Comments
|
Gogs already has support for this. Is there an instance where it doesn't work? |
|
I don't believe it does, the only documentation I have only seen documentation that shows a personal access token being used as the username when accessing the repository via HTTP (e.g. http://token@git.server.com/username/repo.git) I am looking to automatically store the details using the git osxkeychain credentials helper as part of a setup script on my Mac (based on a similar approach used with GitHub, as shown here: https://github.com/MikeMcQuaid/strap/blob/master/bin/strap.sh#L180) However storing just the token as the username with no password does not seem to work - so I cannot use the existing support. |
|
In Gogs, access token can be an alternative to combination of username+password. |
|
Is this also related to doing git actions (push/pull/clone) with access tokens? I just tried creating a token, stored it in my config along with other credentials that I use on other services (GitHub, BitBucket), tried cloning a private repo and it gave the following error: Is there a temporary way to make this work? |
|
@ahasbini I think you should be able to use token as "username" part, with empty password. |
|
I would reclassify this as a security issue. Putting a secret token in the username field is contrary to good security practice. There are many places in the chain from git-to-gogs that might log the username (in plain text): http access logs (=> system logs, web activity logs), git itself (user is echoed at prompt). The token should be passed via "Password" so that it is treated as a secret by all parties. |
|
Why is this not classified as a security issue anymore? Especially when two-factor authentication is enabled on an account, the username+password approach cannot be used at all when cloning a repository using http. This means that using the access token as the username is the only possibility in that instance. Either way, thanks so much for all the hard work that you do on Gogs! |
|
Is it supposed to work with the token in the password now? OS X 12.4 Using the token in the username works, but I am unable to get it to work with the token as the password. |
GitHub allows the usage of personal access tokens as password (as per https://help.github.com/articles/which-remote-url-should-i-use/#cloning-with-https-urls-recommended)
It'd be great if Gogs could also allow this, so that I can give the token to an application I want to use, rather than my actual password.
Many thanks for the great software!
The text was updated successfully, but these errors were encountered: