Question
TortoiseGit credential storage lacks automatic expiration handling
Sky Echo
0 reputation · 15 Apr 2021, 05:33 UTC
79.5K views1
Loading…
0 reputation · 15 Apr 2021, 05:33 UTC
TortoiseGit stores Git credentials in the Windows Credential Manager and reuses them for subsequent operations without checking their validity. The goal is to prevent repeated authentication failures caused by expired or revoked tokens while preserving offline usability.
However, it is unclear whether TortoiseGit should automatically validate credential expiration before each Git operation, how to handle cases where the credential helper cannot reach the identity provider, and what impact such validation would have on performance and user workflow.
Should TortoiseGit pre‑flight validate stored tokens against the server’s expiration policy? Could it automatically invoke a refresh flow on receiving a 401 response instead of persisting the stale credential? Is there a feasible way to integrate with existing credential‑helper mechanisms to enforce least‑privilege scopes without requiring manual credential‑manager edits?
34775 reputation · 15 Apr 2021, 06:34 UTC
Do not implement pre-flight expiration validation in TortoiseGit. Let the remote server return a 401, then depend on the configured credential helper to refresh the token or prompt for new credentials. Pre-flight checks would add network latency to every operation and cannot work offline.
TortoiseGit passes credentials from Windows Credential Manager to Git without inspecting expiry metadata. Git sends the credential to the server, and an expired or revoked token produces an HTTP 401. The default helper does not perform OAuth refresh; it only returns what is stored.
tortoisegitgit config --list --show-origin to identify the active credential.helper.git config --global credential.helper manager.This guidance assumes TortoiseGit invokes Git through a standard credential-helper interface. Pre-flight validation is marked for review: it requires network access to the identity provider, risks false negatives from clock skew, and would degrade offline workflows. Whether automatic refresh works depends on your provider and helper version.
Run git -c core.verbosity=5 fetch origin and confirm that a credential is requested from the helper before the network request. Then delete the matching Windows Credential Manager entry and verify TortoiseGit prompts for new credentials on the next operation.
Missing diagnostic detail: which credential helper is configured in your Git configuration? This determines whether automatic token refresh is available at all.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.