{"record":{"id":"a35d219fe513e046","repo":"abhigyanpatwari/GitNexus","slug":"sending-a-git-credential-over-cleartext-http","errorCode":null,"errorMessage":"Sending a git credential over cleartext http:// (${u.host}) — base64 is not encryption. Prefer https:// where the host supports it.","messagePattern":"Sending a git credential over cleartext http:// \\((.+?)\\) — base64 is not encryption\\. Prefer https:// where the host supports it\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"gitnexus/src/server/git-clone.ts","lineNumber":585,"sourceCode":"    scoped = `${u.protocol}//${u.host}${u.pathname}`;\n  } catch {\n    return undefined;\n  }\n  scoped = scoped.replace(/[\\r\\n\\0]/g, '');\n  return `http.${scoped}.extraHeader`;\n}\n\n/**\n * Warn (do not block) when a credential is about to be sent over cleartext\n * http://. Base64 is encoding, not encryption, so an on-path observer can\n * read the PAT. We keep http:// working for self-hosted Azure DevOps Server.\n */\nfunction warnIfCleartextCredential(url?: string): void {\n  if (!url) return;\n  try {\n    const u = new URL(url);\n    if (u.protocol === 'http:') {\n      logger.warn(\n        `Sending a git credential over cleartext http:// (${u.host}) — base64 is not encryption. Prefer https:// where the host supports it.`,\n      );\n    }\n  } catch {\n    /* resolver already validated the URL */\n  }\n}\n\n/**\n * Build the spawn env for `git`. Suppresses credential prompts and, when a\n * credential resolves (see resolveGitCredential), injects a single\n * host-scoped Authorization header via the `GIT_CONFIG_*` env protocol\n * (git ≥2.31) so credentials never appear in argv or the URL. Appends after\n * any existing `GIT_CONFIG_COUNT` rather than overwriting it. Exported for\n * unit tests.\n */\nexport function buildGitEnv(\n  baseEnv: NodeJS.ProcessEnv,","sourceCodeStart":567,"sourceCodeEnd":603,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/aac7515d2a8c50a1f8f923c6fb77218b333560d6/gitnexus/src/server/git-clone.ts#L567-L603","documentation":"warnIfCleartextCredential fires (without blocking) whenever a resolved git credential is about to be used with an http:// URL: the injected Authorization header is base64, which is encoding rather than encryption, so an on-path observer can read the PAT. http:// remains functional so self-hosted Azure DevOps Server setups keep working.","triggerScenarios":"Any clone where resolveGitCredential produced a PAT and the clone URL's protocol is http: — typically AZURE_DEVOPS_URL configured over cleartext, or an http remote for which a credential resolves. The warning names the specific host from the parsed URL.","commonSituations":"Internal Azure DevOps over http; test environments avoiding self-signed certificate hassle; a proxy or DNS rewrite that downgrades the effective URL to http before it reaches the git host.","solutions":["Use https:// for the remote or AZURE_DEVOPS_URL so the credential header rides an encrypted channel","Front the http-only instance with a TLS proxy and clone via the https endpoint","If http must stay, restrict the network path so no untrusted observer sits between client and host"],"exampleFix":"# before\ngit remote set-url origin http://tfs.internal:8080/DefaultCollection/Proj/_git/repo\n\n# after\ngit remote set-url origin https://tfs.internal/DefaultCollection/Proj/_git/repo","handlingStrategy":"validation","validationCode":"function isCleartextCredentialUrl(url?: string): boolean {\n  if (!url) return false;\n  try { return new URL(url).protocol === 'http:'; } catch { return false; }\n}\n// Before cloning with a resolved credential:\nif (credential && isCleartextCredentialUrl(cloneUrl)) {\n  // block, or require an explicit opt-in for cleartext\n}","typeGuard":"function isCleartextCredentialUrl(url?: string): boolean {\n  if (!url) return false;\n  try {\n    return new URL(url).protocol === 'http:';\n  } catch {\n    return false;\n  }\n}","tryCatchPattern":null,"preventionTips":["Prefer https remotes wherever the host supports TLS","Front http-only internal servers with a TLS proxy","Scope PATs narrowly so an accidental leak stays low-impact"],"tags":["security","git-clone","credentials","http","pat"],"backgroundTag":"cleartext-http-credential-exposure","analyzedSha":"aac7515d2a8c50a1f8f923c6fb77218b333560d6","analyzedAt":"2026-08-20T23:29:22.980Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}