zit 0.3.30 stops sending passwords over plain http:// to other hosts, and
stops a redirect from handing a password to a different host.
No artifact, tag namespace, sync message, or on-disk repository format changed.
A Basic challenge over plain http to another host is refused
When a server gates reads with HTTP Basic, zit answers the challenge with the
password it was given — and did so whatever the URL's scheme. Basic is the
password base64'd, so over http:// it crossed the network readable by
anyone on the path, and because the URL is saved as the checkout's remote,
every later pull and push repeated it.
Now, over http:// to a host that isn't this machine, zit refuses to answer:
zit clone: refusing to send credentials over unencrypted http://host/r; use https://host/r
The check happens when the challenge arrives, not when a credential is
given. A public repository cloned over http with --user is never
challenged and still works. Loopback — localhost, 127.0.0.0/8, ::1 —
is allowed, since plaintext there never leaves the machine; that's how a
forge talks to its own zit child and how the tests run. A name that only
looks like loopback, such as 127.evil.example, is not.
A redirect to another host drops the password
Once a challenge was answered, every later request in the exchange carried
the credential, and a followed redirect rewrote the target to wherever
Location pointed. So a server answering 302 could send the password on to
a different host. A redirect that changes host now drops the credential for
the rest of the exchange, which is what curl and browsers do. A redirect
within the same host keeps it.
An https-to-http redirect was already refused, credential or not, and still is.
Plain http to another host says so
The login card is safer than Basic, since it's signed over the payload and
can't be replayed elsewhere. But over http:// the payload itself still
crosses readable, so a private repository's content is exposed either way.
clone, pull, push, sync and config pull now print one note to
stderr when the URL is plain http to another host:
zit clone: note: http://host/r is unencrypted http; what this exchange carries is readable in transit
Loopback prints nothing.
There is no --insecure-http override. Nothing needs one today, and it's
easy to add if something does.
Compatibility
- No on-disk repository or wire format changed; Fossil RFC revision 00 remains the target.
- A clone, pull or push over
http://to a non-loopback host that is challenged for HTTP Basic now fails with the message above instead of sending the password. Use thehttps://URL. - Syncing over
http://to a non-loopback host adds one line to stderr.
Qualification
zig fmt --check, zig build test, e2e, smoke, git-import-e2e,
git-export-e2e, and dst, plus the three-runner CI battery.