[MNG-8377] Gitlab.com PAT cannot be encrypted in settings.xml in httpHeaders field

**[Tom Benjamins](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=JIRAUSER306344)** opened **[MNG-8377](https://issues.apache.org/jira/browse/MNG-8377?redirect=false)** and commented

Given a gitlab.com account,
a PAT (personal access token) that is passed to the gitlab.com repo via httpHeaders field cannot be encrypted,
while the regular password field for our legacy nexus repo can be encrypted.
settings.xml file is as follows:

    \/some/dir\
    \
        \
            \nexus\
            \bla\
            \{SOMENCRYTPEDPASSWORD==}\\
        \
        \
            \gitlab-maven\
            \
                \
                    \
                        \Private-Token\
                        \{SOMEENCRYPTEDPAT==}\ \
                    \
                \
            \
        \
      
    \

I know there is a possible workaround to add an extension like  https://github.com/causalnet/full-servers-decryption-maven-extension for an individual project, but that is very annoying if you have to do it for every single project.

I just add this issue because this is by far the easiest way for the end user to use this type of connection for ALL projects, while also looking from a security point of view.

 I'm also hoping this is not a duplicate (I could not find a similar issue at least.....)

Any info or opinion about this is highly appreciated.

Tom

---

**Affects:** 3.9.9

Start with the settings.xml server configuration, comparing how encrypted password values are handled with values under the httpHeaders field. Trace Maven's credential processing and verify that an encrypted GitLab PAT is usable as an HTTP header without breaking existing encrypted password support.

Written by the indexing model from the issue text.