Is there any way to hide password from git response?

[arnabbanerjee]

While pushng local changes back to bitbucket server via https we sometimes get below response in case of denial through "Branch permission" restrictions:

[ERROR] remote: 
[ERROR] To https://username:password@git.mycompany.com/scm/ABC/xyz.git
[ERROR]  ! [remote rejected] 1.8 -> 1.8 (pre-receive hook declined)
[ERROR] error: failed to push some refs to 'https://username:password@git.mycompany.com/scm/ABC/xyz.git'

In this case the username/password that used for cloning the repo (or being used for pushing changes back) are shown in clear text. 

Is there a way to hide these from bitbucket server response as this becomes a huge concern in case of ci systems.

[Jeff Thomas]

Do you have the username/password set in the Remotes URL?

git remote -v

If so, you'd need to remove the password from the remote URL.

As an alternative you can look at using SSH which won't show any passwords.

[arnabbanerjee]

Thanks Jeff for the response.

We are actually interacting with bitbucket server through Eclipse jgit API that internally uses https protocol with following format of clone URL:

https://username:password@git.mycompany.com/scm/ABC/xyz.git

IMO it's a bitbucket server behavior to include the username/password too in it's error response, if any, and the git client might not have much to influence.

It would be great if there's a way to configure the server so that the response is less verbose.

[Jeff Thomas]

This is not Bitbucket Server returning the username and password in the response. Bitbucket Server's response only includes the lines beginning with "remote:". The other lines are all by the Git client. You would see a similar behavior if you did the same set of actions on Bitbucket Cloud or Github where a push was rejected.