Can't Login Securely to the CLI

[Shahar-Shiprut]

I just started using the GitHub CLI, and tried to login to my account, but every time i run the git auth login command and follow the instructions it ends up saving my credentials to a plain text files.

I have git installed and enabled the credential manager (set credential.helper to manager in the config), but the gh cli doesn't seem to recognize neither it nor the native windows credential manager.

Is there anything I'm missing or doing wrong? Thanks in advanced :).

(I'm using a Windows 11 PC, and the latest version of the cli)
Photo for reference:

[andyfeller]

@Shahar-Shiprut : Could you share the output of gh version and which of the install methods you used, please?

I know you said you are running the latest version, however not all methods of installation actually install the latest which is v2.49.0 as of last week.

[Shahar-Shiprut]

I installed the cli using the msi installer for windows.
And this is the output of the command:

gh version 2.49.0 (2024-04-30)
https://github.com/cli/cli/releases/tag/v2.49.0

[andyfeller]

Thoughts

In reviewing the code below, I think there is an issue with attempting to save the credentials securely that falls back to insecure:

cli/internal/config/config.go

Lines 328 to 341 in 4896546

	if secureStorage {
	// Try to set the token for this user in the encrypted storage for later switching
	setErr = keyring.Set(keyringServiceName(hostname), username, token)
	if setErr == nil {
	// Clean up the previous oauth_token from the config file, if there were one
	_ = c.cfg.Remove([]string{hostsKey, hostname, usersKey, username, oauthTokenKey})
	}
	}
	insecureStorageUsed := false
	if !secureStorage || setErr != nil {
	// And set the oauth token under the user for later switching
	c.cfg.Set([]string{hostsKey, hostname, usersKey, username, oauthTokenKey}, token)
	insecureStorageUsed = true
	}

The secure authentication storage is built on https://github.com/zalando/go-keyring, which is subsequently built on https://github.com/danieljoos/wincred for interacting with Windows Credential Manager API. 🤔

Where does "Authentication credentials saved in plain text" come from?

This message occurs here:

cli/pkg/cmd/auth/shared/login_flow.go

Lines 203 to 209 in 4896546

	insecureStorageUsed, err := cfg.Login(hostname, username, authToken, gitProtocol, opts.SecureStorage)
	if err != nil {
	return err
	}
	if insecureStorageUsed {
	fmt.Fprintf(opts.IO.ErrOut, "%s Authentication credentials saved in plain text\n", cs.Yellow("!"))
	}

Digging into this a little bit, there is an option that signals whether secure storage should be used:

cli/internal/config/config.go

Lines 322 to 359 in 4896546

	// Login will set user, git protocol, and auth token for the given hostname.
	// If the encrypt option is specified it will first try to store the auth token
	// in encrypted storage and will fall back to the plain text config file.
	func (c *AuthConfig) Login(hostname, username, token, gitProtocol string, secureStorage bool) (bool, error) {
	// In this section we set up the users config
	var setErr error
	if secureStorage {
	// Try to set the token for this user in the encrypted storage for later switching
	setErr = keyring.Set(keyringServiceName(hostname), username, token)
	if setErr == nil {
	// Clean up the previous oauth_token from the config file, if there were one
	_ = c.cfg.Remove([]string{hostsKey, hostname, usersKey, username, oauthTokenKey})
	}
	}
	insecureStorageUsed := false
	if !secureStorage || setErr != nil {
	// And set the oauth token under the user for later switching
	c.cfg.Set([]string{hostsKey, hostname, usersKey, username, oauthTokenKey}, token)
	insecureStorageUsed = true
	}
	if gitProtocol != "" {
	// Set the host level git protocol
	// Although it might be expected that this is handled by switch, git protocol
	// is currently a host level config and not a user level config, so any change
	// will overwrite the protocol for all users on the host.
	c.cfg.Set([]string{hostsKey, hostname, gitProtocolKey}, gitProtocol)
	}
	// Create the username key with an empty value so it will be
	// written even when there are no keys set under it.
	if _, getErr := c.cfg.Get([]string{hostsKey, hostname, usersKey, username}); getErr != nil {
	c.cfg.Set([]string{hostsKey, hostname, usersKey, username}, "")
	}
	// Then we activate the new user
	return insecureStorageUsed, c.activateUser(hostname, username)
	}

Walking up the stack, this logic is called from the gh auth login code which appears to default to secure storage:

cli/pkg/cmd/auth/login/login.go

Lines 197 to 212 in 4896546

	return shared.Login(&shared.LoginOptions{
	IO: opts.IO,
	Config: authCfg,
	HTTPClient: httpClient,
	Hostname: hostname,
	Interactive: opts.Interactive,
	Web: opts.Web,
	Scopes: opts.Scopes,
	Executable: opts.MainExecutable,
	GitProtocol: opts.GitProtocol,
	Prompter: opts.Prompter,
	GitClient: opts.GitClient,
	Browser: opts.Browser,
	SecureStorage: !opts.InsecureStorage,
	SkipSSHKeyPrompt: opts.SkipSSHKeyPrompt,
	})

cli/pkg/cmd/auth/login/login.go

Line 145 in 4896546

cmd.Flags().BoolVar(&opts.InsecureStorage, "insecure-storage", false, "Save authentication credentials in plain text instead of credential store")

Putting ☝️ aside: git and GCM

I have ´gitinstalled and enabled the credential manager (setcredential.helpertomanager` in the config), but the gh cli doesn't seem to recognize neither it nor the native windows credential manager.

Before we focus on those, I'll simply say that this is going to get confusing if we're mixing GCM and GH as separate credentials managers for git. There are multiple configuration settings that affect credential manager that involve digging into git config --list to troubleshoot.

That said, we're not there yet as you're pointing out that gh isn't saving your credentials securely.

[andyfeller]

@Shahar-Shiprut : Were you able to figure out more about why your installation was falling back to insecure storage?

[Shahar-Shiprut]

No, but it seems to be related to the fact that I don't use an admin account on my machine.
I tested the login from an admin account and it seems to save the credentials just fine. But when I tried to use the cli later, on my default account, it didn't recognize that I logged in and asked me to login again.
My guess is that without admin privileges it can't access the windows credential manager and defaults to saving the credentials in plain text.