Files
git/Documentation
Jeff King fdae191003 doc/http-backend: clarify "half-auth" repo configuration
When the http-backend is set up to allow anonymous read but
authenticated write, the http-backend manual suggests
catching only the "/git-receive-pack" POST of the packfile,
not the initial "info/refs?service=git-receive-pack" GET in
which we advertise refs.

This does work and is secure, as we do not allow any write
during the info/refs request, and the information in the ref
advertisement is the same that you would get from a fetch.

However, the configuration required by the server is
slightly more complex. The default `http.receivepack`
setting is to allow pushes if the webserver tells us that
the user authenticated, and otherwise to return a 403
("Forbidden"). That works fine if authentication is turned
on completely; the initial request requires authentication,
and http-backend realizes it is OK to do a push.

But for this "half-auth" state, no authentication has
occurred during the initial ref advertisement. The
http-backend CGI therefore does not think that pushing
should be enabled, and responds with a 403. The client
cannot continue, even though the server would have allowed
it to run if it had provided credentials.

It would be much better if the server responded with a 401,
asking for credentials during the initial contact. But
git-http-backend does not know about the server's auth
configuration (so a 401 would be confusing in the case of a
true anonymous server). Unfortunately, configuring Apache to
recognize the query string and apply the auth appropriately
to receive-pack (but not upload-pack) initial requests is
non-trivial.

The site admin can work around this by just turning on
http.receivepack explicitly in its repositories. Let's
document this workaround.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2013-04-11 07:33:07 -07:00
..
2013-02-05 16:13:32 -08:00
2013-04-07 15:27:23 -07:00
2012-04-20 15:49:16 -07:00
2013-02-14 10:29:01 -08:00
2012-06-19 11:35:19 -07:00
2013-02-05 16:13:32 -08:00
2011-09-06 11:42:12 -07:00
2011-03-11 10:59:16 -05:00
2013-02-27 10:10:28 -08:00
2013-04-03 09:18:01 -07:00
2013-04-07 15:27:23 -07:00
2013-02-07 14:42:16 -08:00
2013-03-17 00:11:11 -07:00
2013-02-07 14:41:45 -08:00