abhigyanpatwari/GitNexus · warning

Sending a git credential over cleartext http:// (${u.host})

Error message

Sending a git credential over cleartext http:// (${u.host}) — base64 is not encryption. Prefer https:// where the host supports it.

What it means

warnIfCleartextCredential fires (without blocking) whenever a resolved git credential is about to be used with an http:// URL: the injected Authorization header is base64, which is encoding rather than encryption, so an on-path observer can read the PAT. http:// remains functional so self-hosted Azure DevOps Server setups keep working.

Source

Thrown at gitnexus/src/server/git-clone.ts:585

    scoped = `${u.protocol}//${u.host}${u.pathname}`;
  } catch {
    return undefined;
  }
  scoped = scoped.replace(/[\r\n\0]/g, '');
  return `http.${scoped}.extraHeader`;
}

/**
 * Warn (do not block) when a credential is about to be sent over cleartext
 * http://. Base64 is encoding, not encryption, so an on-path observer can
 * read the PAT. We keep http:// working for self-hosted Azure DevOps Server.
 */
function warnIfCleartextCredential(url?: string): void {
  if (!url) return;
  try {
    const u = new URL(url);
    if (u.protocol === 'http:') {
      logger.warn(
        `Sending a git credential over cleartext http:// (${u.host}) — base64 is not encryption. Prefer https:// where the host supports it.`,
      );
    }
  } catch {
    /* resolver already validated the URL */
  }
}

/**
 * Build the spawn env for `git`. Suppresses credential prompts and, when a
 * credential resolves (see resolveGitCredential), injects a single
 * host-scoped Authorization header via the `GIT_CONFIG_*` env protocol
 * (git ≥2.31) so credentials never appear in argv or the URL. Appends after
 * any existing `GIT_CONFIG_COUNT` rather than overwriting it. Exported for
 * unit tests.
 */
export function buildGitEnv(
  baseEnv: NodeJS.ProcessEnv,

View on GitHub (pinned to aac7515d2a)

Solutions

1. Use https:// for the remote or AZURE_DEVOPS_URL so the credential header rides an encrypted channel
2. Front the http-only instance with a TLS proxy and clone via the https endpoint
3. If http must stay, restrict the network path so no untrusted observer sits between client and host

Example fix

# before
git remote set-url origin http://tfs.internal:8080/DefaultCollection/Proj/_git/repo

# after
git remote set-url origin https://tfs.internal/DefaultCollection/Proj/_git/repo

function isCleartextCredentialUrl(url?: string): boolean {
  if (!url) return false;
  try { return new URL(url).protocol === 'http:'; } catch { return false; }
}
// Before cloning with a resolved credential:
if (credential && isCleartextCredentialUrl(cloneUrl)) {
  // block, or require an explicit opt-in for cleartext
}

function isCleartextCredentialUrl(url?: string): boolean {
  if (!url) return false;
  try {
    return new URL(url).protocol === 'http:';
  } catch {
    return false;
  }
}

When it happens

Trigger: Any clone where resolveGitCredential produced a PAT and the clone URL's protocol is http: — typically AZURE_DEVOPS_URL configured over cleartext, or an http remote for which a credential resolves. The warning names the specific host from the parsed URL.

Common situations: Internal Azure DevOps over http; test environments avoiding self-signed certificate hassle; a proxy or DNS rewrite that downgrades the effective URL to http before it reaches the git host.

Related errors

• AZURE_DEVOPS_URL is configured over cleartext http:// — the
• Insecure http:// LLM base URLs are only allowed for localhos
• Cloning from private/internal addresses is not allowed
• ${source} entry "${trimmed}" must be an identifier or member
• Refusing to start eval-server on non-loopback host ${host} w

AI-assisted analysis of abhigyanpatwari/GitNexus@aac7515d2a (2026-08-20). Data as JSON: /api/errors/a35d219fe513e046. Report an issue: GitHub.