Git authentication with OAuth access token is supported by every popular Git host including GitHub, GitLab and BitBucket.
Credential helpers Git Credential Manager (GCM) and git-credential-oauth
generate OAuth credentials.
Following RFC 6749, the application prints a link for the user to authorize access in browser.
A loopback redirect communicates the response including access token to the application.
For security, RFC 6749 recommends that OAuth response also includes expiry date and refresh token.
After expiry, applications can use the refresh token to generate a new access token without user reauthorization in browser.
GitLab and BitBucket set the expiry at two hours.
(GitHub doesn't populate expiry or refresh token.)
However the Git credential protocol has no attribute to store the OAuth refresh token (unrecognised attributes are silently discarded).
This means that the user has to regularly reauthorize the helper in browser.
On a browserless system, this is particularly intrusive, requiring a second device.
Introduce a new attribute oauth_refresh_token
.
This is especially useful when a storage helper and a read-only OAuth helper are configured together.
Recall that credential fill
calls each helper until it has a non-expired password.
helper = storage
helper = oauth
The OAuth helper can use the stored refresh token forwarded by credential fill
to generate a fresh access token without opening the browser.
See https://github.com/hickford/git-credential-oauth/pull/3/files for an implementation tested with this patch.
Add support for the new attribute to credential-cache.
Eventually, I hope to see support in other popular storage helpers.
Alternatives considered: ask helpers to store all unrecognised attributes.
This seems excessively complex for no obvious gain.
Helpers would also need extra information to distinguish between confidential and non-confidential attributes.
Workarounds: GCM abuses the helper get/store/erase contract to store the refresh token during credential get as the password for a fictitious host (I wrote this hack).
This workaround is only feasible for a monolithic helper with its own storage.
d208bfd (credential
: new attribute password_expiry_utc
, 2023-02-18, Git v2.40.0-rc1 -- merge) and a5c7656 (credential
: new attribute oauth_refresh_token
, 2023-04-21, Git v2.41.0-rc0 -- merge listed in batch #18) introduced new credential attributes.
libsecret assumes attribute values are non-confidential and unchanging, so we encode the new attributes in the secret, separated by newline:
hunter2
password_expiry_utc=1684189401
oauth_refresh_token=xyzzy
This is extensible and backwards compatible.
The credential protocol already assumes that attribute values do not contain newlines.
Alternatives considered: store password_expiry_utc
in a libsecret attribute.
This has the problem that libsecret creates new items rather than overwrites when attribute values change.