fix: re-authenticate smart HTTP redirects#2686
Merged
Merged
Conversation
Sebastian Thiel (Byron)
force-pushed
the
try-redirect-re-auth
branch
7 times, most recently
from
July 2, 2026 08:24
ec82e66 to
334c2e7
Compare
Sebastian Thiel (Byron)
marked this pull request as ready for review
July 2, 2026 08:24
Sebastian Thiel (Byron)
force-pushed
the
try-redirect-re-auth
branch
from
July 2, 2026 08:28
334c2e7 to
059c8af
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 334c2e75b1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
Issue #2685 reports that cloning a repository behind a Tangled initial smart-HTTP redirect fails because gix rejects cross-authority redirected bases. Git allows this class of initial redirect, but updates the effective base URL and re-keys credential state to that redirected base before retrying authentication or issuing follow-up RPCs. Git baseline: git/git/http.c update_url_from_redirect() derives the redirected base from the requested tail, and http_request_recoverable() then calls credential_from_url() for the new base. The regression coverage now requires a cross-host redirected handshake to be followed, requires the follow-up POST to target the redirected host, verifies the original Basic identity is cleared, and verifies a redirected 401 updates TransportWithoutIO::to_url() before the authentication retry path observes it. Redirect helper unit tests cover cross-authority base reconciliation, auth reuse safety, and https-to-http rejection. The fix exposes redirected backend base URLs through the Http trait, shares curl/reqwest worker redirect state with their outer backend objects, lets base reconciliation accept safe cross-authority redirects with matching tails, keeps identity reuse limited to same authority or same-host http-to-https upgrades, updates the HTTP transport URL and identity from the effective base, relaxes reqwest redirect policy accordingly, and rebuilds configured credential helper cascades from each Get action URL. Validation: - cargo test -p gix-transport --features "http-client-curl http-client-insecure-credentials maybe-async/is_sync" --test blocking-transport-http-only redirected_ - cargo test -p gix-transport --features "http-client-curl maybe-async/is_sync" redirect::tests - cargo test -p gix-transport --features "http-client-reqwest http-client-insecure-credentials maybe-async/is_sync" --test blocking-transport-http-reqwest - cargo test -p gix --features credentials repository::config::config_snapshot::credential_helpers - cargo test -p gix-transport --features "http-client-curl http-client-insecure-credentials maybe-async/is_sync" --test blocking-transport-http-only - cargo test -p gix-transport --tests - git diff --check
Co-authored-by: Sebastian Thiel <[email protected]>
It extracts the URL from the input action, which is relevant in case of redirects which changes the initial url. Co-authored-by: Sebastian Thiel <[email protected]>
Sebastian Thiel (Byron)
force-pushed
the
try-redirect-re-auth
branch
from
July 2, 2026 08:58
059c8af to
a5d4616
Compare
Sebastian Thiel (Byron)
enabled auto-merge
July 2, 2026 08:59
Sebastian Thiel (Byron)
disabled auto-merge
July 2, 2026 09:43
Member
Author
|
After 43m I have force-merged this PR as the ARM runner seems to have failed silently again. It really looks like it has issues: https://github.com/GitoxideLabs/gitoxide/actions/runs/28578072792/job/84731323802?pr=2686. What do you think Eliah Kagan (@EliahKagan), is it time to disable or neutralize it? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tasks
This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.
gix clone https://tangled.org/me.webbeef.org/beavernow worksEverything below this line was generated by Codex GPT-5.
Created by Codex on behalf of Byron. Byron will review before this is ready to merge.
Fixes #2685.
Summary
This updates smart HTTP redirect handling so accepted initial redirects become visible to the transport/authentication layer instead of staying hidden inside the HTTP backend. After a redirect, the HTTP transport updates its canonical URL, clears credentials unless the old and new authorities are safe for reuse, and lets the existing handshake authentication retry obtain credentials for the redirected URL.
Git baseline:
http.cin/Users/byron/dev/github.com/git/gitderives redirected bases from the requested tail inupdate_url_from_redirect()and re-keys credentials from the effective URL inhttp_request_recoverable().Changes
Http::redirected_base_url()with a defaultNoneimplementation.httpstohttp.Action::GetURL, keeping immediate store/erase paired with that same URL.Validation
cargo test -p gix-transport --features "http-client-curl http-client-insecure-credentials maybe-async/is_sync" --test blocking-transport-http-only relative_redirected_handshake_updates_url_before_returning -- --nocapturecargo fmt --all --checkcargo test -p gix-transport --features "http-client-curl http-client-insecure-credentials maybe-async/is_sync" --test blocking-transport-http-onlycargo test -p gix-transport --features "http-client-reqwest http-client-insecure-credentials maybe-async/is_sync" --test blocking-transport-http-reqwestcargo test -p gix-transport --features "http-client-curl maybe-async/is_sync" redirect::testscargo test -p gix --features credentials repository::config::config_snapshot::credential_helperscargo test -p gix-transport --testscargo check -p gix-transport --no-default-features --features "blocking-client http-client-reqwest maybe-async/is_sync"cargo check -p gix-transport --no-default-features --features "blocking-client http-client-curl http-client-insecure-credentials maybe-async/is_sync"codex review --commit 67e7af7f8a293d5c80f8132a8d0473129e5c6062Manual Tangled network clone check was not run.