diff options
| author | Jeff King <peff@peff.net> | 2013-04-12 23:33:36 -0400 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2013-04-13 22:27:06 -0700 |
| commit | b0808819e5806f5ff01ffcc34db2796d180ad0d9 (patch) | |
| tree | b9643d7d4de9b0d0db0cb58102729b5e96c7dd62 /Documentation/git-http-backend.txt | |
| parent | 3813a33de5f9e8224eb2bd2ebae167b3bb00ef73 (diff) | |
| download | git-b0808819e5806f5ff01ffcc34db2796d180ad0d9.tar.gz | |
doc/http-backend: match query-string in apache half-auth example
When setting up a "half-auth" repository in which reads can
be done anonymously but writes require authentication, it is
best if the server can require authentication for both the
ref advertisement and the actual receive-pack POSTs. This
alleviates the need for the admin to set http.receivepack in
the repositories, and means that the client is challenged
for credentials immediately, instead of partway through the
push process (and git clients older than v1.7.11.7 had
trouble handling these challenges).
Since detecting a push during the ref advertisement requires
matching the query string, and this is non-trivial to do in
Apache, we have traditionally punted and instructed users to
just protect "/git-receive-pack$". This patch provides the
mod_rewrite recipe to actually match the ref advertisement,
which is preferred.
While we're at it, let's add the recipe to our test scripts
so that we can be sure that it works, and doesn't get broken
(either by our changes or by changes in Apache).
Signed-off-by: Jeff King <peff@peff.net>
Acked-by: Jakub Narębski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'Documentation/git-http-backend.txt')
| -rw-r--r-- | Documentation/git-http-backend.txt | 32 |
1 files changed, 24 insertions, 8 deletions
diff --git a/Documentation/git-http-backend.txt b/Documentation/git-http-backend.txt index cad18ceb9d..e3bcdb50e3 100644 --- a/Documentation/git-http-backend.txt +++ b/Documentation/git-http-backend.txt @@ -80,7 +80,30 @@ ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/ ---------------------------------------------------------------- + To enable anonymous read access but authenticated write access, -require authorization with a LocationMatch directive: +require authorization for both the initial ref advertisement (which we +detect as a push via the service parameter in the query string), and the +receive-pack invocation itself: ++ +---------------------------------------------------------------- +RewriteCond %{QUERY_STRING} service=git-receive-pack [OR] +RewriteCond %{REQUEST_URI} /git-receive-pack$ +RewriteRule ^/git/ - [E=AUTHREQUIRED:yes] + +<LocationMatch "^/git/"> + Order Deny,Allow + Deny from env=AUTHREQUIRED + + AuthType Basic + AuthName "Git Access" + Require group committers + Satisfy Any + ... +</LocationMatch> +---------------------------------------------------------------- ++ +If you do not have `mod_rewrite` available to match against the query +string, it is sufficient to just protect `git-receive-pack` itself, +like: + ---------------------------------------------------------------- <LocationMatch "^/git/.*/git-receive-pack$"> @@ -207,13 +230,6 @@ auth.require = ( # ...and set up auth.backend here ---------------------------------------------------------------- + -Note that unlike the similar setup with Apache, we can easily match the -query string for receive-pack, catching the initial request from the -client. This means that the server administrator does not have to worry -about configuring `http.receivepack` for the repositories (the default -value, which enables it only in the case of authentication, is -sufficient). -+ To require authentication for both reads and writes: + ---------------------------------------------------------------- |