@matheusbsbs / matheus-bagliano / commits / 5913fd26aa

t5550: add netrc tests for http 401/403

git allows using .netrc file to supply credentials for HTTP auth. Three test cases are added in this patch to provide missing coverage when cloning over HTTP using .netrc file: - First test case checks that the git clone is successful when credentials are provided via .netrc file - Second test case checks that the git clone fails when the .netrc file provides invalid credentials. The HTTP server is expected to return 401 Unauthorized in such a case. The test checks that the user is provided with a prompt for username/password on 401 to provide the valid ones. - Third test case checks that the git clone fails when the .netrc file provides credentials that are valid but do not have permission for this user. For example one may have multiple tokens in GitHub and uses the one which was not authorized for cloning this repo. In such a case the HTTP server returns 403 Forbidden. For this test, the apache.conf is modified to return a 403 on finding a forbidden-user. No prompt for username/password is expected after the 403 (unlike 401). This is because prompting may wipe out existing credentials or conflict with custom credential helpers. Signed-off-by: Ashlesh Gawande <git@ashlesh.me> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ashlesh Gawande committed Jan 7, 2026 at 13:17 UTC 5913fd26aad32bd028a8fe4e5b80fccc28e118af
4 files changed +41 -2
t/lib-httpd.sh
+11 -2
@@ -319,13 +319,22 @@ setup_askpass_helper() {
319 '
320 }
321
322 -set_askpass() {
322 +set_askpass () {
323 >"$TRASH_DIRECTORY/askpass-query" &&
324 echo "$1" >"$TRASH_DIRECTORY/askpass-user" &&
325 echo "$2" >"$TRASH_DIRECTORY/askpass-pass"
326 }
327
328 -expect_askpass() {
328 +set_netrc () {
329 + # $HOME=$TRASH_DIRECTORY
330 + echo "machine $1 login $2 password $3" >"$TRASH_DIRECTORY/.netrc"
331 +}
332 +
333 +clear_netrc () {
334 + rm -f "$TRASH_DIRECTORY/.netrc"
335 +}
336 +
337 +expect_askpass () {
338 dest=$HTTPD_DEST${3+/$3}
339
340 {
t/lib-httpd/apache.conf
+4
@@ -238,6 +238,10 @@ SSLEngine On
238 AuthName "git-auth"
239 AuthUserFile passwd
240 Require valid-user
241 +
242 + # return 403 for authenticated user: forbidden-user@host
243 + RewriteCond "%{REMOTE_USER}" "^forbidden-user@host"
244 + RewriteRule ^ - [F]
245 </Location>
246
247 <LocationMatch "^/auth-push/.*/git-receive-pack$">
t/lib-httpd/passwd
+1
@@ -1 +1,2 @@
1 user@host:$apr1$LGPmCZWj$9vxEwj5Z5GzQLBMxp3mCx1
2 +forbidden-user@host:$apr1$LGPmCZWj$9vxEwj5Z5GzQLBMxp3mCx1
t/t5550-http-fetch-dumb.sh
+25
@@ -102,6 +102,31 @@ test_expect_success 'cloning password-protected repository can fail' '
102 expect_askpass both wrong
103 '
104
105 +test_expect_success 'using credentials from netrc to clone successfully' '
106 + test_when_finished clear_netrc &&
107 + set_askpass wrong &&
108 + set_netrc 127.0.0.1 user@host pass@host &&
109 + git clone "$HTTPD_URL/auth/dumb/repo.git" clone-auth-netrc &&
110 + expect_askpass none
111 +'
112 +
113 +test_expect_success 'netrc unauthorized credentials (prompt after 401)' '
114 + test_when_finished clear_netrc &&
115 + set_askpass wrong &&
116 + set_netrc 127.0.0.1 user@host pass@wrong &&
117 + test_must_fail git clone "$HTTPD_URL/auth/dumb/repo.git" clone-auth-netrc-401 &&
118 + expect_askpass both wrong
119 +'
120 +
121 +test_expect_success 'netrc authorized but forbidden credentials (fail on 403)' '
122 + test_when_finished clear_netrc &&
123 + set_askpass wrong &&
124 + set_netrc 127.0.0.1 forbidden-user@host pass@host &&
125 + test_must_fail git clone "$HTTPD_URL/auth/dumb/repo.git" clone-auth-netrc-403 2>err &&
126 + expect_askpass none &&
127 + grep "The requested URL returned error: 403" err
128 +'
129 +
130 test_expect_success 'http auth can use user/pass in URL' '
131 set_askpass wrong &&
132 git clone "$HTTPD_URL_USER_PASS/auth/dumb/repo.git" clone-auth-none &&