git-ecosystem/git-credential-manager · error · Trace2Exception

Unencrypted HTTP is not recommended for GitLab. Ensure the…

Error message

Unencrypted HTTP is not recommended for GitLab. Ensure the repository remote URL is using HTTPS or see {Constants.HelpUrls.GcmUnsafeRemotes} about how to allow unsafe remotes.

What it means

GenerateCredentialAsync refuses to send credentials over unencrypted HTTP to a GitLab host unless the user explicitly opts in via AllowUnsafeRemotes. The exception message points to the GCM help page on unsafe remotes.

Solutions

Change the remote to HTTPS: `git remote set-url origin https://gitlab.example.com/group/repo.git`.
If HTTP is intentionally safe in your network, enable it with `git config --global credential.allowUnsafeRemotes true` (or GCM_ALLOW_UNSAFE_REMOTES=true).
Set up TLS on the GitLab instance / reverse proxy so HTTPS works.

Example fix

// before
git remote set-url origin http://gitlab.example.com/group/repo.git
// after
git remote set-url origin https://gitlab.example.com/group/repo.git

Defensive patterns

Strategy: validation

Validate before calling

// Check remote scheme before pushing
var remote = new Uri("git remote get-url origin".Bash().Trim());
if (remote.Scheme == Uri.UriSchemeHttp)
  throw new InvalidOperationException("Remote uses HTTP; switch to HTTPS or set credential.allowUnsafeRemotes=true");

Try / catch

try {
  await git.PushAsync();
} catch (Trace2Exception ex) when (ex.Message.Contains("Unencrypted HTTP")) {
  // fix the remote URL and retry
  await git.RemoteSetUrlAsync("origin", remote.ToString().Replace("http://", "https://"));
}

Prevention

Always add GitLab remotes with https:// URLs
Never enable credential.allowUnsafeRemotes on shared/public networks
Audit remotes periodically: git remote -v | grep http://

When it happens

Trigger: A git remote URL for a GitLab repository uses http:// instead of https:// and Constants.HelpUrls setting GCM_ALLOW_UNSAFE_REMOTES / credential.allowUnsafeRemotes is not enabled.

Common situations: Self-hosted GitLab instances configured with plain HTTP; typos in remote URLs (http vs https); internal-network GitLab setups without TLS termination.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/584c4f536a9c0a06. Report an issue: GitHub.

Appendix: source

Thrown at src/GitLab/GitLabHostProvider.cs:102

            if (response == null)
            {
                return false;
            }

            // as seen at eg. https://salsa.debian.org/apt-team/apt.git
            // not always present https://gitlab.com/gitlab-org/gitlab/-/issues/349464
            return response.Headers.Contains("X-Gitlab-Feature-Category");
        }

        public override async Task<ICredential> GenerateCredentialAsync(GitRequest request)
        {
            ThrowIfDisposed();

            // We should not allow unencrypted communication and should inform the user
            if (!Context.Settings.AllowUnsafeRemotes &&
                StringComparer.OrdinalIgnoreCase.Equals(request.Protocol, "http"))
            {
                throw new Trace2Exception(Context.Trace2,
                    "Unencrypted HTTP is not recommended for GitLab. " +
                    "Ensure the repository remote URL is using HTTPS " +
                    $"or see {Constants.HelpUrls.GcmUnsafeRemotes} about how to allow unsafe remotes.");
            }

            Uri remoteUri = request.GetRemoteUri();

            AuthenticationModes authModes = GetSupportedAuthenticationModes(remoteUri);

            AuthenticationPromptResult promptResult = await _gitLabAuth.GetAuthenticationAsync(remoteUri, request.UserName, authModes);

            switch (promptResult.AuthenticationMode)
            {
                case AuthenticationModes.Basic:
                case AuthenticationModes.Pat:
                    return promptResult.Credential;

                case AuthenticationModes.Browser:

View on GitHub (pinned to e8ce762cd0)