Leaving the Proxy Password Out of Git’s URL
Let Git obtain a missing proxy password through its credential machinery, then check the helper separately if disk persistence matters.
A proxy URL can contain the username without containing the password:
[http]
proxy = http://[email protected]:8080Git attempts to obtain the missing password through its credential machinery. Replace the account and endpoint with your own. The Git build, HTTP backend and proxy authentication method must support the arrangement you use.
Choose what you need to keep out of storage
| Requirement | What to arrange |
|---|---|
| No password in the configured proxy URL | Use the username-only form and supply the missing secret through the supported credential mechanism. |
| No reusable password persisted on disk | Choose an approved helper whose storage behavior meets that requirement. Omitting the URL password alone is insufficient. |
| Integrated authentication | Use the supported method and applicable process identity rather than treating it as another spelling of a Basic password. |
Helpers can store credentials in an OS credential store, memory, a file or another system. Inspect the helper configured for this account and URL before deciding that the password is no longer persisted.
Keep the other copies in view
An inline helper that echoes a hard-coded password simply stores it somewhere else. A password-bearing environment variable or command argument can also enter scripts, diagnostics, process inspection or shell history.
The useful record is small: proxy endpoint, authentication method, credential source and storage policy. Keep secrets out of that record. Origin credentials and proxy credentials can use different support paths, so a successful website login does not establish this proxy arrangement.