gitproto: document the orig-path keying choice on challengeURLFor

27e145f→main·

Soph·1mo ago·1 file·+9 added/-0 removed

Path-aware credential helpers (credential.useHttpPath=true) interact with our redirect-handling in a subtle way: we key the helper Lookup on the user-typed path, not the redirect target's path, so creds stored against the URL the user configured stay findable when the redirect rewrites paths. The trade-off is a slightly imprecise Approve/Reject key for path-aware helpers — not a credential leak (the creds still only reach hosts the user trusted) but worth calling out so a future maintainer doesn't "fix" the behaviour the other way and break the common case.

Doc-only.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Sessions

73c782592a3eView transcript

[?
can you fix the conflict and rebase onto main?Claude Code·Opus 4.7[1m]·1 step](/content/gh/entireio/git-sync/session/ec48fae0-26ba-4958-acf2-08a0644c73bf#timeline-73c782592a3e/index.html)

Changes

1

• internal/gitproto

• Msmarthttp.go+9

780 unmodified lines

781
782
783
784
785
786
787
788
789
790
791
792
793
794
795

780 unmodified lines

// one would query (and possibly approve/reject) credentials under the
// wrong helper key. The original repo path is preserved so the key still
// matches what the user configured.
//
// We deliberately key on orig.Path rather than res.Request.URL.Path so
// credentials the user stored against the URL they typed remain findable
// when a redirect rewrites paths (e.g. github.com/owner/repo redirected
// to cdn.example/mirror/owner/repo). Trade-off: for path-aware helpers
// (credential.useHttpPath=true) the Approve/Reject key may be less
// precise than the actual challenge URL. Not a credential leak — creds
// only ever reach hosts the user already trusted enough to store them
// against — just a helper-audit-trail imprecision.
func challengeURLFor(orig *url.URL, res *http.Response) *url.URL {
    if res == nil || res.Request == nil || res.Request.URL == nil {
        return orig