git-ecosystem / git-ecosystem/git-credential-manager

GitLab: Ignore username from Git credential input when looking up and generating credentials

Open
#2,270 7 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

auth-issue host:gitlab
Dominant language
C#
Stars
9.3k
Forks
2.9k
Avg merge
7d 1h
Merged PRs (30d)
14

Description

Version

2.7.0.0

Operating system

Windows

OS version or distribution

Windows 11

Git hosting provider(s)

GitLab

Other hosting provider

No response

(Azure DevOps only) What format is your remote URL?

None

Can you access the remote repository directly in the browser?

Yes, I can access the repository

Expected behavior

Expected Behavior

The GitLab provider should:

  1. Completely ignore the username from Git's credential input with OAuth

Rationale

  • Using the input username can cause incorrect credential lookups and confusing authentication prompts
Actual behavior

Current Behavior

When Git passes a username in the credential request (e.g., username=test when remote.origin.url=https://test@repo.git), the GitLab provider:

  1. User runs git pull
  2. GCM checks for token for user test - token is missing (not in cache, that's OK)
  3. GCM asks user to login using browser
  4. GCM Stores token in cache with user oauth (not test)
  5. git pull is successful
  6. User runs git pull again
  7. GCM checks for token for user test - token is not found due to invalid user!
  8. GCM asks user again to login using browser
Logs

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the GitLab provider's credential lookup and OAuth credential-generation entry points, then reproduce the issue's two consecutive git pull requests with a supplied username. The work is done when the username is ignored for lookup and generation, so the OAuth token is stored and reused without another browser login.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, git
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.