5

I want to run git command(let's say push command) with username and password. But password is having a @ sing at the end. so it's giving me this error.

Couldn't resolve host '@github.com'

my sample git command is like this.

git push https://username:password@@github.com/username/test.git

I think that ending @ sign of the password is the reason for the error. But anyhow I want to find a way to run this command as a one step, without entering username and password at a second step.

Prasad Lakmal
  • 149
  • 1
  • 9

1 Answers1

9

From the RFC 1738:

"...Only alphanumerics [0-9a-zA-Z], the special characters "$-_.+!*'()," [not including the quotes - ed], and reserved characters used for their reserved purposes may be used unencoded within a URL."

So you have to URL encode the @ character:

git push https://username:password%40@github.com/username/test.git

However, this is extremely unsafe. Not only URL are clearly readable in HTTP traffic, but they are being cached by hosts, logged by loggers, and stored in many ways by proxies and routers along the path to the destination. Why do you ever need a password if it is failing its purpose to provide authentication? Don't use a password if you don't need to authenticate.

Furthermore, providing password in URL is being deprecated by browser, read for example http://support2.microsoft.com/default.aspx?scid=kb;[LN];834489

There are several more secure ways to perform one-step push without having to type in your password, for example using SSH keys or git config credential.helper

Claudio Floreani
  • 2,441
  • 28
  • 34
  • HTTPS URLs are encrypted since it's part of HTTP protocol which sits on top of TLS. So it's safe to pass sensitive data. You probably mean that domain part is not encrypted which is true and is used by SNI and DNS. – Maksim Shamihulau Nov 11 '19 at 15:05
  • Corporate proxies can be (and often are) configured to decrypt and monitor all https/TLS traffic. And besides that, the only thing that prevents a malicious attacker to read https traffic is a certificate. And since traffic is often analyzed and archivied, once a certificate is leaked it can be decripted even months and years after. So change your passwords often and over all don’t forget that the strongest menace to security is convenience. – Claudio Floreani Nov 29 '19 at 13:26