microsoft/aspire · error · ArgumentException

Credential-bearing HTTP sources cannot be persisted.

Error message

Credential-bearing HTTP sources cannot be persisted.

What it means

PackageSourceOverrideMappings.Create validates that a package source override URL does not embed credentials (userinfo in the URL or query-string keys/access tokens) because those mappings are persisted, which would leak secrets to disk. Any credential-bearing HTTP source is rejected with ArgumentException naming the packageSourceOverride parameter.

Solutions

  1. Strip credentials from the URL and pass only the plain https source (https://pkgs.dev.azure.com/org/project/_packaging/feed/nuget/v3/index.json).
  2. Provide credentials out-of-band via a NuGet.config source entry with %VARIABLE% credential providers, not the override.
  3. Use a credential provider (e.g. `dotnet nuget update source` with stored creds or the Artifacts credential provider).
  4. If local-only testing requires credentials, use a non-persisted mechanism instead of the package source override mapping.

Example fix

// before
var mappings = PackageSourceOverrideMappings.Create(
    "https://user:pat123@pkgs.dev.azure.com/org/_packaging/feed/nuget/v3/index.json", channel, null);
// after
var mappings = PackageSourceOverrideMappings.Create(
    "https://pkgs.dev.azure.com/org/_packaging/feed/nuget/v3/index.json", channel, null);
Defensive patterns

Strategy: validation

Validate before calling

if (Uri.TryCreate(source, UriKind.Absolute, out var uri) && !string.IsNullOrEmpty(uri.UserInfo))
    throw new ArgumentException("Source URL must not embed credentials.");
if (source.Contains("key=") || source.Contains("api-key="))
    throw new ArgumentException("Source URL must not contain query-string credentials.");

Try / catch

try
{
    var mappings = PackageSourceOverrideMappings.Create(source, channel, null);
}
catch (ArgumentException ex)
{
    Console.Error.WriteLine("Remove credentials from the package source URL; use a credential provider instead.");
}

Prevention

When it happens

Trigger: Passing a source URL like https://user:pat@pkgs.example.com/v3/index.json or one containing ?api-key=... / ?key=... to Create (e.g. via ASPIRE_CLI_PACKAGE_SOURCE_OVERRIDE or CLI packaging setup).

Common situations: Pasting an authenticated Azure Artifacts or MyGet feed URL that includes a PAT; copying a URL from a browser session that appended a token query parameter.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/72d72269d97edf9b. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Cli/Packaging/PackageSourceOverrideMappings.cs:49

    public static string? GetMissingLocalDirectory(string source)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(source);

        var sourceKind = ClassifySource(source, out var localDirectory);
        if (sourceKind is PackageSourceKind.Http)
        {
            return null;
        }

        return Directory.Exists(localDirectory) ? null : localDirectory;
    }

    public static PackageMapping[] Create(string packageSourceOverride, PackageChannel? requestedChannel, string? nugetServiceIndexOverride)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(packageSourceOverride);
        if (HasCredentialMaterial(packageSourceOverride))
        {
            throw new ArgumentException("Credential-bearing HTTP sources cannot be persisted.", nameof(packageSourceOverride));
        }

        var mappings = new List<PackageMapping>
        {
            new("Aspire*", packageSourceOverride)
        };

        if (requestedChannel?.Mappings is not null)
        {
            foreach (var mapping in requestedChannel.Mappings)
            {
                if (mapping.PackageFilter.StartsWith("Aspire", StringComparison.OrdinalIgnoreCase))
                {
                    continue;
                }

                mappings.Add(mapping);
            }

View on GitHub (pinned to 25830f84bd)