{"record":{"id":"f93e1c0f6b23ed94","repo":"golang/go","slug":"requested-a-credential-for-s-but-git-credential","errorCode":null,"errorMessage":"requested a credential for %s, but 'git credential fill' provided one for %s\n","messagePattern":"requested a credential for (.+?), but 'git credential fill' provided one for (.+?)\n","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/auth/gitauth.go","lineNumber":58,"sourceCode":"\tif dir == \"\" {\n\t\t// Prevent config-injection attacks by requiring an explicit working directory.\n\t\t// See https://golang.org/issue/29230 for details.\n\t\tpanic(\"'git' invoked in an arbitrary directory\") // this should be caught earlier.\n\t}\n\tcmd := exec.Command(\"git\", \"credential\", \"fill\")\n\tcmd.Dir = dir\n\tcmd.Stdin = strings.NewReader(fmt.Sprintf(\"url=%s\\n\", url))\n\tout, err := cmd.CombinedOutput()\n\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"'git credential fill' failed (url=%s): %w\\n%s\", url, err, out)\n\t}\n\tparsedPrefix, username, password := parseGitAuth(out)\n\tif parsedPrefix == \"\" {\n\t\treturn \"\", nil, fmt.Errorf(\"'git credential fill' failed for url=%s, could not parse url\\n\", url)\n\t}\n\t// Check that the URL Git gave us is a prefix of the one we requested.\n\tif !strings.HasPrefix(url, parsedPrefix) {\n\t\treturn \"\", nil, fmt.Errorf(\"requested a credential for %s, but 'git credential fill' provided one for %s\\n\", url, parsedPrefix)\n\t}\n\treq, err := http.NewRequest(\"HEAD\", parsedPrefix, nil)\n\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"internal error constructing HTTP HEAD request: %v\\n\", err)\n\t}\n\treq.SetBasicAuth(username, password)\n\t// Asynchronously validate the provided credentials using a HEAD request,\n\t// allowing the git credential helper to update its cache without blocking.\n\t// This avoids repeatedly prompting the user for valid credentials.\n\t// This is a best-effort update; the primary validation will still occur\n\t// with the caller's client.\n\t// The request is intercepted for testing purposes to simulate interactions\n\t// with the credential helper.\n\tintercept.Request(req)\n\tgo updateGitCredentialHelper(client, req, out)\n\n\t// Return the parsed prefix and headers, even if credential validation fails.\n\t// The caller is responsible for the primary validation.","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/auth/gitauth.go#L40-L76","documentation":"Returned by runGitAuth as a safety check: after git returns a parsedPrefix, the exporter verifies the requested URL starts with parsedPrefix. If git hands back credentials for a different (non-prefix-matching) URL, the mismatch is rejected. This protects against a credential helper or git config (url.*.insteadOf) returning credentials for an unrelated host.","triggerScenarios":"git's `credential fill` returns a url (or protocol+host+path) that does not prefix-match the requested URL — e.g. git rewrites or redirects to a different host, or the helper returns a stored credential for the wrong host.","commonSituations":"A gitconfig `url.<base>.insteadOf` rule rewriting the host; a corporate proxy rewriting the request; a custom helper returning the wrong entry; case-sensitivity differences in the host.","solutions":["Inspect url rewriting rules: `git config --get-regexp 'url\\..*\\.insteadof'`.","Ensure the credential helper stores entries keyed on the actual host you fetch from.","Use a simpler helper (store) to isolate whether a custom helper is the cause.","Manually verify the returned prefix: `printf 'url=<your-url>\\n' | git credential fill`."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Reject url-rewriting rules that would change the host before relying on GOAUTH=git.\nout, err := exec.Command(\"git\", \"config\", \"--get-regexp\", `url\\..*\\.insteadof`).Output()\nif err == nil && len(out) > 0 {\n    return fmt.Errorf(\"git url.insteadOf rules active; may cause credential host mismatch:\\n%s\", out)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid `url.<base>.insteadOf` rules that rewrite the module host.","Store credentials keyed on the actual fetch host.","Switch to the plain `store` helper to isolate custom-helper issues."],"tags":["go-toolchain","goauth","git","authentication","security","validation","credentials"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}