# Simplest way to pass username & password to Git, when using http(s)?

**URL:** <https://forum.ansible.com/t/simplest-way-to-pass-username-password-to-git-when-using-http-s/20621>\
**Category:** Ansible Project\
**Created:** [February 18, 2016, 7:25pm UTC](https://forum.ansible.com/t/simplest-way-to-pass-username-password-to-git-when-using-http-s/20621 "2016-02-18T19:25:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric3](https://avatars.discourse-cdn.com/v4/letter/e/51bf81/32.png) [@eric3](https://forum.ansible.com/u/eric3)\
**Post date:** [February 18, 2016, 7:25pm UTC](https://forum.ansible.com/t/simplest-way-to-pass-username-password-to-git-when-using-http-s/20621/1 "2016-02-18T19:25:10Z")

</div>

I’m using Ansible to clone / update a Git repository that I’m accessing via HTTP, using username & password. Except that the “git” task really doesn’t help me.

I can’t put those credentials in the URL, because they then end up stashed in the config of the git repository. That causes problems downstream, including disclosure of the password to anyone else who has access to the box, and if the password changes, failures in the Ansible script.

One work-around I came up with was the following:

```auto
# set up the Git credential cache...
- name: Set up credential cache
  command: git config --global credential.helper cache

# shove credentials into it...
- name: Fetch git repositories
  shell: printf 'protocol=http\nhost=git.example.com\nusername={{ username }}\npassword={{ password }}\n' | git credential approve ; if [-d reponame.git]; then (cd reponame.git && git pull); else git clone http://{{ username }}@git.example.com/git/reponame reponame.git ; fi

```

```auto
This works, but doesn't take care of various corner cases that the Ansible "git" task does take care of. Also potentially puts the password in the log file. Next approximation is to write the input to git credential approve to a file, using the "template" task, but that leaves behind a file I have to delete. So at that point, rather than using credential "cache", use the "store".

```

```auto

```

```auto
So I ended up with this:

```

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [February 20, 2016, 4:44pm UTC](https://forum.ansible.com/t/simplest-way-to-pass-username-password-to-git-when-using-http-s/20621/2 "2016-02-20T16:44:29Z")

</div>

Can’t you just do?

```auto
repo=[http://username:password@git.example.com/git/reponame](http://git.example.com/git/reponame)

```

---

<div class="post-metadata">

**Author:** ![eric3](https://avatars.discourse-cdn.com/v4/letter/e/51bf81/32.png) [@eric3](https://forum.ansible.com/u/eric3)\
**Post date:** [February 22, 2016, 7:40pm UTC](https://forum.ansible.com/t/simplest-way-to-pass-username-password-to-git-when-using-http-s/20621/3 "2016-02-22T19:40:09Z")

</div>

> Can’t you just do?
> 
> ```auto
> repo=[http://username:password@git.example.com/git/reponame](http://git.example.com/git/reponame)
> 
> ```

As I said in my original post, that causes problems downstream, including breakage if the password changes, as well as password disclosure to anyone who has access to the same part of the file system on the box.

And that’s just the problems I’ve discovered so far.

Eric.

---

<div class="post-metadata">

**Author:** ![Toshio\_Kuratomi](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Toshio\_Kuratomi](https://forum.ansible.com/u/Toshio_Kuratomi)\
**Post date:** [February 23, 2016, 3:08pm UTC](https://forum.ansible.com/t/simplest-way-to-pass-username-password-to-git-when-using-http-s/20621/4 "2016-02-23T15:08:28Z")

</div>

This wouldn’t be a bug but it might be a feature. I’m not sure if we’d want to do all the credential cache stuff inside of the git module or might like to split that out into a separate module.

If the password can be given to git on stdin in your case, that does seem like a way to add it to the current git module. A pr for that would be welcome.

-Toshio