Re: transfer.credentialsInUrl should warn about personal access tokens in user field #leftoverbits

On 2025-01-10 22:06, brian m. carlson wrote:

No, this is Basic auth.  It's just that GitHub will look at either the
username or password field for the token.

Thanks Brian and Junio for the discussion. I understand your aversion to introducing GitHub-specific PAT detection logic.

The better solution would be for GitHub to stop accepting PAT in the username field. Hopefully that will happen one day. It's undocumented,
so its usage ought to diminish.

To speed that along, I've edited the offending StackOverflow answer https://stackoverflow.com/a/70320541/284795