{"record":{"id":"584c4f536a9c0a06","repo":"git-ecosystem/git-credential-manager","slug":"unencrypted-http-is-not-recommended-for-gitlab-en","errorCode":null,"errorMessage":"Unencrypted HTTP is not recommended for GitLab. Ensure the repository remote URL is using HTTPS or see {Constants.HelpUrls.GcmUnsafeRemotes} about how to allow unsafe remotes.","messagePattern":"Unencrypted HTTP is not recommended for GitLab\\. Ensure the repository remote URL is using HTTPS or see (.+?) about how to allow unsafe remotes\\.","errorType":"exception","errorClass":"Trace2Exception","httpStatus":null,"severity":"error","filePath":"src/GitLab/GitLabHostProvider.cs","lineNumber":102,"sourceCode":"            if (response == null)\n            {\n                return false;\n            }\n\n            // as seen at eg. https://salsa.debian.org/apt-team/apt.git\n            // not always present https://gitlab.com/gitlab-org/gitlab/-/issues/349464\n            return response.Headers.Contains(\"X-Gitlab-Feature-Category\");\n        }\n\n        public override async Task<ICredential> GenerateCredentialAsync(GitRequest request)\n        {\n            ThrowIfDisposed();\n\n            // We should not allow unencrypted communication and should inform the user\n            if (!Context.Settings.AllowUnsafeRemotes &&\n                StringComparer.OrdinalIgnoreCase.Equals(request.Protocol, \"http\"))\n            {\n                throw new Trace2Exception(Context.Trace2,\n                    \"Unencrypted HTTP is not recommended for GitLab. \" +\n                    \"Ensure the repository remote URL is using HTTPS \" +\n                    $\"or see {Constants.HelpUrls.GcmUnsafeRemotes} about how to allow unsafe remotes.\");\n            }\n\n            Uri remoteUri = request.GetRemoteUri();\n\n            AuthenticationModes authModes = GetSupportedAuthenticationModes(remoteUri);\n\n            AuthenticationPromptResult promptResult = await _gitLabAuth.GetAuthenticationAsync(remoteUri, request.UserName, authModes);\n\n            switch (promptResult.AuthenticationMode)\n            {\n                case AuthenticationModes.Basic:\n                case AuthenticationModes.Pat:\n                    return promptResult.Credential;\n\n                case AuthenticationModes.Browser:","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/GitLab/GitLabHostProvider.cs#L84-L120","documentation":"GenerateCredentialAsync refuses to send credentials over unencrypted HTTP to a GitLab host unless the user explicitly opts in via AllowUnsafeRemotes. The exception message points to the GCM help page on unsafe remotes.","triggerScenarios":"A git remote URL for a GitLab repository uses http:// instead of https:// and Constants.HelpUrls setting GCM_ALLOW_UNSAFE_REMOTES / credential.allowUnsafeRemotes is not enabled.","commonSituations":"Self-hosted GitLab instances configured with plain HTTP; typos in remote URLs (http vs https); internal-network GitLab setups without TLS termination.","solutions":["Change the remote to HTTPS: `git remote set-url origin https://gitlab.example.com/group/repo.git`.","If HTTP is intentionally safe in your network, enable it with `git config --global credential.allowUnsafeRemotes true` (or GCM_ALLOW_UNSAFE_REMOTES=true).","Set up TLS on the GitLab instance / reverse proxy so HTTPS works."],"exampleFix":"// before\ngit remote set-url origin http://gitlab.example.com/group/repo.git\n// after\ngit remote set-url origin https://gitlab.example.com/group/repo.git","handlingStrategy":"validation","validationCode":"// Check remote scheme before pushing\nvar remote = new Uri(\"git remote get-url origin\".Bash().Trim());\nif (remote.Scheme == Uri.UriSchemeHttp)\n  throw new InvalidOperationException(\"Remote uses HTTP; switch to HTTPS or set credential.allowUnsafeRemotes=true\");","typeGuard":null,"tryCatchPattern":"try {\n  await git.PushAsync();\n} catch (Trace2Exception ex) when (ex.Message.Contains(\"Unencrypted HTTP\")) {\n  // fix the remote URL and retry\n  await git.RemoteSetUrlAsync(\"origin\", remote.ToString().Replace(\"http://\", \"https://\"));\n}","preventionTips":["Always add GitLab remotes with https:// URLs","Never enable credential.allowUnsafeRemotes on shared/public networks","Audit remotes periodically: git remote -v | grep http://"],"tags":["gitlab","http","security","remote-url"],"backgroundTag":"invalid-url","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}