curl always truncates the username after 63 characters

Question

I am using the _netrc file to store client credentials for basic authentication and noticed that msysgit always truncates the username at the 63rd character.

Here's how my %HOME%\_netrc looks like:

# username for local repos
machine localhost
login 12345678901234567890123456789012345678901234567890123456789012345
password secret

I have defined a username of 65 characters.

And then I tried to clone a repository:

C:\work>git clone https://localhost:44305/git myrepo

and here's the output (with GIT_CURL_VERBOSE=1 and GIT_SSL_NO_VERIFY=true):

Cloning into 'myrepo'...
* About to connect() to localhost port 44305 (#0)
*   Trying 127.0.0.1... * connected
* Connected to localhost (127.0.0.1) port 44305 (#0)
* successfully set certificate verify locations:
*   CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
* 0x214a410 is at send pipe head!
* Expire cleared
* SSL connection using AES128-SHA
* Server certificate:
*        subject: CN=localhost
*        start date: 2012-10-23 06:41:25 GMT
*        expire date: 2022-10-23 00:00:00 GMT
*        issuer: CN=localhost
*        SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
> GET /git/info/refs?service=git-upload-pack HTTP/1.1
User-Agent: git/1.7.11.msysgit.1
Host: localhost:44305
Accept: */*
Pragma: no-cache

< HTTP/1.1 401 Unauthorized
< Cache-Control: private
< Content-Type: text/html; charset=utf-8
< Server: Microsoft-IIS/8.0
< WWW-Authenticate: Basic Realm="MyRealm"
< X-AspNet-Version: 4.0.30319
< X-SourceFiles: =?UTF-8?B?Yzpcd29ya1xUb0REXFdlYkFwcGxpY2F0aW9uMVxXZWJBcHBsaWNhdGlvbjFcZ2l0XGluZm9ccmVmcw==?=
< X-Powered-By: ASP.NET
< Date: Thu, 21 Feb 2013 13:05:56 GMT
< Content-Length: 4975
<
* Ignoring the response-body
* Connection #0 to host localhost left intact
* Issue another request to this URL: 'https://localhost:44305/git/info/refs?service=git-upload-pack'
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (127.0.0.1) port 44305 (#0)
* 0x214a410 is at send pipe head!
* Server auth using Basic with user '123456789012345678901234567890123456789012345678901234567890123☻'
> GET /git/info/refs?service=git-upload-pack HTTP/1.1
Authorization: Basic MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzAjpzZWNyZXQ=
User-Agent: git/1.7.11.msysgit.1
Host: localhost:44305
Accept: */*
Pragma: no-cache

< HTTP/1.1 200 OK
< Cache-Control: private
< Content-Type: text/plain; charset=utf-8
< Server: Microsoft-IIS/8.0
< X-AspNet-Version: 4.0.30319
< X-SourceFiles: =?UTF-8?B?Yzpcd29ya1xUb0REXFdlYkFwcGxpY2F0aW9uMVxXZWJBcHBsaWNhdGlvbjFcZ2l0XGluZm9ccmVmcw==?=
< X-Powered-By: ASP.NET
< Date: Thu, 21 Feb 2013 13:05:56 GMT
< Content-Length: 2
<
* Expire cleared
* Connection #0 to host localhost left intact
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (127.0.0.1) port 44305 (#0)
* 0x214a410 is at send pipe head!
* Server auth using Basic with user '123456789012345678901234567890123456789012345678901234567890123☻'
> GET /git/HEAD HTTP/1.1
Authorization: Basic MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzAjpzZWNyZXQ=
User-Agent: git/1.7.11.msysgit.1
Host: localhost:44305
Accept: */*
Pragma: no-cache

< HTTP/1.1 200 OK
< Cache-Control: private
< Content-Type: text/plain; charset=utf-8
< Server: Microsoft-IIS/8.0
< X-AspNet-Version: 4.0.30319
< X-SourceFiles: =?UTF-8?B?Yzpcd29ya1xUb0REXFdlYkFwcGxpY2F0aW9uMVxXZWJBcHBsaWNhdGlvbjFcZ2l0XEhFQUQ=?=
< X-Powered-By: ASP.NET
< Date: Thu, 21 Feb 2013 13:05:56 GMT
< Content-Length: 2
<
* Expire cleared
* Connection #0 to host localhost left intact
warning: You appear to have cloned an empty repository.

Notice how msysgit truncated the username at the 63rd character:

123456789012345678901234567890123456789012345678901234567890123☻

Then I disabled the _netrc file and tried to type the username and password interactively but this time I tried entering 256 characters:

C:\work>git clone https://localhost:44305/git myrepo

and here's the interactive session:

Cloning into 'myrepo'...
* Couldn't find host localhost in the _netrc file; using defaults
* About to connect() to localhost port 44305 (#0)
*   Trying 127.0.0.1... * connected
* Connected to localhost (127.0.0.1) port 44305 (#0)
* successfully set certificate verify locations:
*   CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
* 0x22ea410 is at send pipe head!
* Expire cleared
* SSL connection using AES128-SHA
* Server certificate:
*        subject: CN=localhost
*        start date: 2012-10-23 06:41:25 GMT
*        expire date: 2022-10-23 00:00:00 GMT
*        issuer: CN=localhost
*        SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
> GET /git/info/refs?service=git-upload-pack HTTP/1.1
User-Agent: git/1.7.11.msysgit.1
Host: localhost:44305
Accept: */*
Pragma: no-cache

* The requested URL returned error: 401
* Closing connection #0
Username for 'https://localhost:44305': 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456 
Password for 'https://1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456@localhost:44305':
* Couldn't find host localhost in the _netrc file; using defaults
* About to connect() to localhost port 44305 (#0)
*   Trying 127.0.0.1... * connected
* Connected to localhost (127.0.0.1) port 44305 (#0)
* successfully set certificate verify locations:
*   CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
* SSL re-using session ID
* 0x22ea410 is at send pipe head!
* Expire cleared
* SSL connection using AES128-SHA
* Server certificate:
*        subject: CN=localhost
*        start date: 2012-10-23 06:41:25 GMT
*        expire date: 2022-10-23 00:00:00 GMT
*        issuer: CN=localhost
*        SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
> GET /git/info/refs?service=git-upload-pack HTTP/1.1
User-Agent: git/1.7.11.msysgit.1
Host: localhost:44305
Accept: */*
Pragma: no-cache

< HTTP/1.1 401 Unauthorized
< Cache-Control: private
< Content-Type: text/html; charset=utf-8
< Server: Microsoft-IIS/8.0
< WWW-Authenticate: Basic Realm="GitApi"
< X-AspNet-Version: 4.0.30319
< X-SourceFiles: =?UTF-8?B?Yzpcd29ya1xUb0REXFdlYkFwcGxpY2F0aW9uMVxXZWJBcHBsaWNhdGlvbjFcZ2l0XGluZm9ccmVmcw==?=
< X-Powered-By: ASP.NET
< Date: Thu, 21 Feb 2013 13:16:35 GMT
< Content-Length: 4975
<
* Ignoring the response-body
* Connection #0 to host localhost left intact
* Issue another request to this URL: 'https://localhost:44305/git/info/refs?service=git-upload-pack'
* Couldn't find host localhost in the _netrc file; using defaults
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (127.0.0.1) port 44305 (#0)
* 0x22ea410 is at send pipe head!
* Server auth using Basic with user '123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345'
> GET /git/info/refs?service=git-upload-pack HTTP/1.1
Authorization: Basic MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1OnNlY3JldA==
User-Agent: git/1.7.11.msysgit.1
Host: localhost:44305
Accept: */*
Pragma: no-cache

< HTTP/1.1 200 OK
< Cache-Control: private
< Content-Type: text/plain; charset=utf-8
< Server: Microsoft-IIS/8.0
< X-AspNet-Version: 4.0.30319
< X-SourceFiles: =?UTF-8?B?Yzpcd29ya1xUb0REXFdlYkFwcGxpY2F0aW9uMVxXZWJBcHBsaWNhdGlvbjFcZ2l0XGluZm9ccmVmcw==?=
< X-Powered-By: ASP.NET
< Date: Thu, 21 Feb 2013 13:16:35 GMT
< Content-Length: 2
<
* Expire cleared
* Connection #0 to host localhost left intact
* Couldn't find host localhost in the _netrc file; using defaults
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (127.0.0.1) port 44305 (#0)
* 0x22ea410 is at send pipe head!
* Server auth using Basic with user '123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345'
> GET /git/HEAD HTTP/1.1
Authorization: Basic MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1OnNlY3JldA==
User-Agent: git/1.7.11.msysgit.1
Host: localhost:44305
Accept: */*
Pragma: no-cache

< HTTP/1.1 200 OK
< Cache-Control: private
< Content-Type: text/plain; charset=utf-8
< Server: Microsoft-IIS/8.0
< X-AspNet-Version: 4.0.30319
< X-SourceFiles: =?UTF-8?B?Yzpcd29ya1xUb0REXFdlYkFwcGxpY2F0aW9uMVxXZWJBcHBsaWNhdGlvbjFcZ2l0XEhFQUQ=?=
< X-Powered-By: ASP.NET
< Date: Thu, 21 Feb 2013 13:16:35 GMT
< Content-Length: 2
<
* Expire cleared
* Connection #0 to host localhost left intact
warning: You appear to have cloned an empty repository.

This time the username was truncated at the 255th character.

I have tried using msysgit under a standard MS-DOS prompt as well as a PowerShell prompt and a Git Bash prompt with the same results.

So here are my questions:

1. Is this some limitation of msysgit?
2. Could this limit be increased (both for the _netrc file and the interactive prompt)?
3. Are there any workarounds?

And if you ask why do I need such long usernames, well, it's because my goal is to send OAuth tokens for a custom GIT server, the same way GitHub does it (except that their OAuth tokens are pretty short).

---

UPDATE:

Further investigating it seems that the problem is with cURL which is what GIT uses for HTTP client. I am able to reproduce the exact same behavior with the following command:

curl --netrc -kv https://localhost:44305/git

So am retaging the question.

---

UPDATE 2:

Further investigating in netrc.c:

/* make sure we have room for at least this size: */
#define LOGINSIZE 64
#define PASSWORDSIZE 64

I am starting to lose my optimism for a good outcome from this.

Answer 1

Yes, it seems to be limitation of curl. The code you're referencing is not current: this, I think, is, and has the same values.

For windows, cygwin version of git fixes some limitations that msysgit has, such as path size limit. However, as this is a limitation of curl and not msysgit, there's not much it can do, and indeed when I tested there was the same behaviour.

Note though that this seems to be a limitation of .netrc file usage, as neither HTTP spec or curl programmatic interface has that limit. Indeed, if you just specify it in the url, it seems to work:

C:\REMenu>git remote add origin https://1234567890123456789012345678901234567890123456789012345678901234567890@github.com/romaonthego/REMenu.git

C:\REMenu>git push origin master
...
* Server auth using Basic with user '1234567890123456789012345678901234567890123456789012345678901234567890'
..
Password for 'https://1234567890123456789012345678901234567890123456789012345678
[email protected]':

If you need to use _netrc, I think your only option is to compile curl yourself if you need this to work.

If you don't have to, you do have other options:

• running a local proxy that specifies user/pass for you, and using that proxy when connecting, specifying no user/pass for git or curl
• using username in the url
• using ssh-based urls

---

Edit: just to recap, limits we've seen so far:

• _netrc: 64 (curl .netrc limit)
• interactive: 256
• credential.helper wincred: 512 (windows credential store limit)
• credential.helper plain: 4000+
• url: 4000+
• proxy: unlimited (should only be limited by HTTP and proxy software)