path: root/t/lib-httpd
diff options
authorJeff King <>2013-04-13 03:33:36 (GMT)
committerJunio C Hamano <>2013-04-14 05:27:06 (GMT)
commitb0808819e5806f5ff01ffcc34db2796d180ad0d9 (patch)
treeb9643d7d4de9b0d0db0cb58102729b5e96c7dd62 /t/lib-httpd
parent3813a33de5f9e8224eb2bd2ebae167b3bb00ef73 (diff)
doc/http-backend: match query-string in apache half-auth example
When setting up a "half-auth" repository in which reads can be done anonymously but writes require authentication, it is best if the server can require authentication for both the ref advertisement and the actual receive-pack POSTs. This alleviates the need for the admin to set http.receivepack in the repositories, and means that the client is challenged for credentials immediately, instead of partway through the push process (and git clients older than v1.7.11.7 had trouble handling these challenges). Since detecting a push during the ref advertisement requires matching the query string, and this is non-trivial to do in Apache, we have traditionally punted and instructed users to just protect "/git-receive-pack$". This patch provides the mod_rewrite recipe to actually match the ref advertisement, which is preferred. While we're at it, let's add the recipe to our test scripts so that we can be sure that it works, and doesn't get broken (either by our changes or by changes in Apache). Signed-off-by: Jeff King <> Acked-by: Jakub Narębski <> Signed-off-by: Junio C Hamano <>
Diffstat (limited to 't/lib-httpd')
1 files changed, 18 insertions, 0 deletions
diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf
index 938b4cf..542241b 100644
--- a/t/lib-httpd/apache.conf
+++ b/t/lib-httpd/apache.conf
@@ -40,6 +40,9 @@ ErrorLog error.log
<IfModule !mod_authz_user.c>
LoadModule authz_user_module modules/
+<IfModule !mod_authz_host.c>
+ LoadModule authz_host_module modules/
@@ -110,6 +113,21 @@ SSLEngine On
Require valid-user
+RewriteCond %{QUERY_STRING} service=git-receive-pack [OR]
+RewriteCond %{REQUEST_URI} /git-receive-pack$
+RewriteRule ^/half-auth-complete/ - [E=AUTHREQUIRED:yes]
+<Location /half-auth-complete/>
+ Order Deny,Allow
+ Deny from env=AUTHREQUIRED
+ AuthType Basic
+ AuthName "Git Access"
+ AuthUserFile passwd
+ Require valid-user
+ Satisfy Any
<IfDefine DAV>
LoadModule dav_module modules/
LoadModule dav_fs_module modules/