git-ecosystem/git-credential-manager · error · Trace2Exception

Missing 'password' in response

Error message

Missing 'password' in response

What it means

Thrown in GetAuthenticationViaHelperAsync when the helper response declares `mode=basic` but no 'password' key is present. Together with the username, the password is mandatory to build the AuthenticationModes.Basic GitCredential.

Solutions

  1. Ensure the helper always emits `password=` with the credential when reporting mode=basic.
  2. Quote/escape special characters in the password when constructing helper output.
  3. Fall back to mode=pat if the helper cannot obtain a password reliably.

Example fix

// before
echo "mode=basic"
echo "username=$USER"
# password never printed
// after
echo "mode=basic"
echo "username=$USER"
echo "password=$PASS"
Defensive patterns

Strategy: validation

Validate before calling

// Assert password present before printing basic-mode response
[ -n "$PASS" ] || { echo "password missing" >&2; exit 1; }

Try / catch

try {
  var result = await auth.GetAuthenticationAsync(...);
} catch (Trace2Exception ex) when (ex.Message.Contains("Missing 'password' in response")) {
  // re-prompt or switch to PAT flow
}

Prevention

When it happens

Trigger: Helper emits `mode=basic` and `username=...` but omits `password=`; helper aborted its password prompt but still reported basic mode.

Common situations: Helpers that read the secret from ssh-agent/keychain which returned nothing; password special characters mangled by quoting so the line was dropped; scripts written for a different credential protocol.

Related errors

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/ee2365f01dddc375. Report an issue: GitHub.

Appendix: source

Thrown at src/GitLab/GitLabAuthentication.cs:249

                    {
                        // Username is optional for PATs
                    }

                    return new AuthenticationPromptResult(
                        AuthenticationModes.Pat, new GitCredential(patUserName, pat));

                case "browser":
                    return new AuthenticationPromptResult(AuthenticationModes.Browser);

                case "basic":
                    if (!resultDict.TryGetValue("username", out userName))
                    {
                        throw new Trace2Exception(Context.Trace2, "Missing 'username' in response");
                    }

                    if (!resultDict.TryGetValue("password", out string password))
                    {
                        throw new Trace2Exception(Context.Trace2, "Missing 'password' in response");
                    }

                    return new AuthenticationPromptResult(
                        AuthenticationModes.Basic, new GitCredential(userName, password));

                default:
                    throw new Trace2Exception(Context.Trace2,
                        $"Unknown mode value in response '{responseMode}'");
            }
        }

        public async Task<OAuth2TokenResult> GetOAuthTokenViaBrowserAsync(Uri targetUri, IEnumerable<string> scopes)
        {
            ThrowIfUserInteractionDisabled();

            var oauthClient = new GitLabOAuth2Client(HttpClient, Context.Settings, targetUri, Context.Trace2);

            // We require a desktop session to launch the user's default web browser

View on GitHub (pinned to e8ce762cd0)