A password is suddenly asked on my token access to github, and even the error message quote it as outdated.

[ThibauldMichel]

Select Topic Area

Question

Body

I have set up my local git to access to Github via access token using this command:

git push https://<GITHUB_ACCESS_TOKEN>@github.com/<GITHUB_USERNAME>/<REPOSITORY_NAME>.git

Until recently it worked well.
But for an unknown reason, a password was asked when I used the same command line yesterday.
Ironically, the error message itself quote this authentication method is outdated.

On branch master
nothing to commit, working tree clean
Password for 'https://<GITHUB_ACCESS_TOKEN>@github.com':
remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/<GITHUB_USERNAME>/<REPOSITORY_NAME>.git/

So my questions are:

• Has anything changed recently in the authentication system that has made my git push script invalid?
• Why is there still the option to enter a password in git push/clone/etc... even though it is outdated and not usable anymore?

[jzelAdmin2006]

Hi @ThibauldMichel

I understand how authentication changes can be both surprising and frustrating. Thank you for reaching out, I'll try to clarify the situation for you.

1. "Has anything changed recently in the authentication system that has made my git push script invalid?"

Yes, GitHub made a significant change by discontinuing support for password-based authentication for repository operations. Your method of embedding the access token directly in the URL, though previously functional, is now discouraged due to security concerns. It can expose the token in command-line histories, logs, and other insecure places. Instead, GitHub recommends using Personal Access Tokens (PAT) in a more secure manner or adopting SSH keys.

The key distinction between the outdated method you employed and the modern approach is in the security and handling of these tokens:

• Outdated Method: Embedding the token in the URL exposes it to multiple vulnerabilities.
• Supported Method: Utilizing a PAT with a Git credential manager or SSH keys offers more security. The PAT is stored securely and is presented when required by the credential manager, without the risk associated with manual URL entry.

2. "Why is there still the option to enter a password in git push/clone/etc... even though it is outdated and not usable anymore?"

The password prompt is a general feature of Git, not solely a GitHub-specific function. Git is engineered to interface with a myriad of hosting platforms, each with individual authentication systems. Therefore, even if GitHub doesn't support password prompts anymore, Git will present this prompt when it deems authentication necessary.

Furthermore, I'd like to highlight the benefits of using SSH Keys which I personally couldn't recommend more:

• Security: With SSH keys, your private key (which must be kept confidential) never departs from your computer. Instead of the actual key, only a cryptographic proof is sent during the authentication process.
• Convenience: SSH keys don't expire and, once established, can ensure a smooth and prompt-free authentication process.

To set up SSH keys, you'd produce a key pair (public and private). Your public key is added to GitHub, while your private key stays secure on your machine. The crucial advantage here is that the private key never needs to be shared or transmitted.

For additional details on using SSH keys with GitHub, you can explore this GitHub documentation.

I hope this helps!

Best regards
jzelAdmin2006

[ThibauldMichel]

Thank you very much for your patience and pedagogy. It is now perfectly clear why the changes have been made and what are the guidelines.

Kind regards,

Thibauld

[jzelAdmin2006]

Hi @ThibauldMichel

I'm glad that my answer was helpful. If you like, you can also support me by marking this question as answered. That would be just a free click for you and I would very much appreciate it 😉.

Best regards
JZEL

[jphme]

@jzelAdmin2006

I am sorry but I don't understand this at all. I am locked out of imporntant Repos suddenly late at night with the same message:

remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.
fatal: Authentication failed for ...../'

I have absolutely no idea, why that message is suddenly displayed (the token was previously stored in the credential manager).

The linked URL in that error message is completely unhelpful. The link to the documentation you attached is also completely unhelpful. I have my ssh key even setup in GitHub. I know ssh. I have my PAT stored in an environment variable. Yet my workflow/muscle memory is still with https clone/remotes.

If you break workflows, please give us a simple step to fix this (e.g.: "enter these 3 commands to switch to ssh remote or enter these 3 commands to setup your git credential store newly"). I have to search for random Stackoverflow Threads on Google to fix this (still unsuccessfully ) because i have no idea from the error message why I suddenly can't access my repos anymore and what the solution is. Not cool!

[jphme]

Ok I was able to fix it. The reason? My Github PAT was expired....

I don't know if this is intended or for security reasons, but how in god´s name can an error message be so misleading?

[jzelAdmin2006]

Hi @jphme

I apologize for the inconvenience and frustration you've experienced. I'm not from GitHub, so I can't change things regarding the misleading messages. However, I still recommend you to switch to SSH (among other things, an SSH key never expires and it is more secure).

SSH, by the way, belongs the most straightforward basics for most GitHub users, but here is a step by step guide anyway:

• Type "ssh-keygen" in your Git Bash.
• Note the path where the private key will be saved and press enter (if you don't want a custom one)
• Enter a passphrase if you want to encrypt your private key (the passphrase will have to be entered each time to use SSH)
• Go to the location of your private key and copy the content of the id_rsa.pub file (your public key)
• Go to https://github.com/settings/keys and press [New SSH key]
• Give your SSH key a title and enter the public key
• Clone your repo with the SSH url which you can copy from the web browser like this
  

Best regards
jzelAdmin2006

[jphme]

@jzelAdmin2006 sorry for my tone, it was late at night and i was frustrated because I couldn't start a training run due to this ;-) .

As I wrote, I have my SSH keys generated (and even added to Github), I just never switched over to SSH.
I guess the correct way to update a remote (that would be what I searched for) would be something like git remote origin set-url [email protected]..... or would anything else be needed to switch over from a https-based remote to a ssh-based remote?

Many Thanks!

[jzelAdmin2006]

Hi @jphme

No problem, I think every real developer will eventually come across a situation like that at night ;).

In this case, what you are searching for is probably the following command:

• git remote set-url origin [email protected]:<GITHUB_USERNAME>/<REPOSITORY_NAME>.git

Alternatively, you can also just clone the repo with SSH. Both options should work completely though.

Let me know if that helps.

Best regards
jzelAdmin2006

[jzelAdmin2006]

Thank you very much for your patience and pedagogy. It is now perfectly clear why the changes have been made and what are the guidelines.

Kind regards,

Thibauld

Select Topic Area

Question

Body

I have set up my local git to access to Github via access token using this command:

git push https://<GITHUB_ACCESS_TOKEN>@github.com/<GITHUB_USERNAME>/<REPOSITORY_NAME>.git

Until recently it worked well. But for an unknown reason, a password was asked when I used the same command line yesterday. Ironically, the error message itself quote this authentication method is outdated.

On branch master nothing to commit, working tree clean Password for 'https://<GITHUB_ACCESS_TOKEN>@github.com': remote: Support for password authentication was removed on August 13, 2021. remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication. fatal: Authentication failed for 'https://github.com/<GITHUB_USERNAME>/<REPOSITORY_NAME>.git/

So my questions are:

• Has anything changed recently in the authentication system that has made my git push script invalid?
• Why is there still the option to enter a password in git push/clone/etc... even though it is outdated and not usable anymore?

Hi @ThibauldMichel

I hope you're doing well. Just a gentle reminder about our previous discussion. If you find the answers provided satisfactory and helpful, marking the thread as answered would greatly help my profile and contributions be recognized. It's a free and small gesture that would mean a lot.

Thank you for your consideration.

Best regards
jzelAdmin2006

[ghostinhershell]

Hey there! 👋

Thanks for posting in the GitHub Community, @ThibauldMichel! We're happy you're here. You are more likely to get a useful response if you are posting your question in the applicable category. The Accessibility category is a place for our community to discuss and provide feedback on the digital accessibility of GitHub products. Digital accessibility means that GitHub tools, and technologies, are designed and developed so that people with disabilities can use them.

Also, if you did receive an answer to your question here, I would encourage you to mark the response as the answer so that it can help others who have similar questions find the answer in the future.

I've gone ahead and moved this to the correct category for you. Good luck!

[IkaLukava]

Useless Responses!!!

[burners-git-cicd]

Yes, doesn't solve anything. I need to automatically clone a different repo during build and I get all kind of "fatal: could not read Password for 'https://******@github.com': No such device or address" nonsense even when using a PAT.

This is really blocking my effort to get things going. Why not keep it simple but instead add more and more layers of security on top of it?

We need to be able to do our work and not spend days figuring out the latest "security improvement". Seriously. This needs to stop.

[rahulkolawale1999]

remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/rahulkolawale1999/DevOps.git/'

can someone give me the correct steps to solve this issue?