# Maven username/password only works when embedded in url for some servers

**URL:** <https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542>\
**Category:** Old Forum Archive\
**Created:** [May 15, 2014, 5:40pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542 "2014-05-15T17:40:00Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![paleozogt](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/paleozogt/32/104_2.png) [@paleozogt](https://discuss.gradle.org/u/paleozogt)\
**Post date:** [May 15, 2014, 5:40pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/1 "2014-05-15T17:40:00Z")

</div>

With Gradle v1.11/v1.12, specifying a maven username/password via credentials is not working:

```gradle
maven {
     credentials {
        username "${GITHUB_USERNAME}"
        password "${GITHUB_PASSWORD}"
    }
    url "https://raw.githubusercontent.com/foobar/repo/master/releases"
}

```

but specifying it inside the url is working:

```gradle
maven {
     url "https://${GITHUB_USERNAME}:${GITHUB_PASSWORD}@raw.githubusercontent.com/foobar/repo/master/releases"
}

```

What is going on here?

---

<div class="post-metadata">

**Author:** ![carlo\_lf](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/carlo_lf/32/1881_2.png) [@carlo\_lf](https://discuss.gradle.org/u/carlo_lf)\
**Post date:** [May 15, 2014, 7:42pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/2 "2014-05-15T19:42:00Z")

</div>

I put the credentials into “gradle.properties” and in “build.gradle” I have this:

```gradle
maven {
     url 'http://mycompany.ycy.de/artifactory/repo'
  credentials {
   username artifactoryUser
   password artifactoryPassword
  }
 }

```

This works (at least in 1.11).

---

<div class="post-metadata">

**Author:** ![paleozogt](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/paleozogt/32/104_2.png) [@paleozogt](https://discuss.gradle.org/u/paleozogt)\
**Post date:** [May 15, 2014, 8:17pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/3 "2014-05-15T20:17:00Z")

</div>

I wonder if it depends on the way that the server does auth. Perhaps github does it differently than your server.

On thing that’s sort of unusual about github: if you don’t auth with [raw.githubusercontent.com](http://raw.githubusercontent.com), it returns a 404 Not Found rather than a 401 Unauthorized. In the debug logs I can see that gradle is trying to do an HTTP HEAD on the artifact url, where it gets a 404 (which implies that it didn’t send auth info).

Perhaps gradle doesn’t auth until it does an HTTP GET, or it only auths if the server returns 404 Not Found?

---

<div class="post-metadata">

**Author:** ![paleozogt](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/paleozogt/32/104_2.png) [@paleozogt](https://discuss.gradle.org/u/paleozogt)\
**Post date:** [May 15, 2014, 8:26pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/4 "2014-05-15T20:26:00Z")

</div>

Looking more closely at the debug log, the line that says

```gradle
Target auth state: UNCHALLENGED

```

is really suspicious. Why isn’t it sending along auth info?

```gradle
14:23:23.927 [DEBUG] [org.gradle.api.internal.externalresource.transport.http.HttpClientHelper] Performing HTTP HEAD: https://raw.githubusercontent.com/foobar/repo/master/releases/com/foobar/myartifact/0.0.1/mylib-0.0.1.pom
14:23:24.116 [DEBUG] [org.apache.http.impl.conn.PoolingClientConnectionManager] Connection request: [route: {s}->https://raw.githubusercontent.com][total kept alive: 0; route allocated: 0 of 5; total allocated: 0 of 10]
14:23:24.128 [DEBUG] [org.apache.http.impl.conn.PoolingClientConnectionManager] Connection leased: [id: 0][route: {s}->https://raw.githubusercontent.com][total kept alive: 0; route allocated: 1 of 5; total allocated: 1 of 10]
14:23:24.990 [DEBUG] [org.apache.http.impl.conn.DefaultClientConnectionOperator] Connecting to raw.githubusercontent.com:443
14:23:25.319 [DEBUG] [org.apache.http.client.protocol.RequestAddCookies] CookieSpec selected: best-match
14:23:25.331 [DEBUG] [org.apache.http.client.protocol.RequestAuthCache] Auth cache not set in the context
14:23:25.331 [DEBUG] [org.apache.http.client.protocol.RequestTargetAuthentication] Target auth state: UNCHALLENGED
14:23:25.332 [DEBUG] [org.apache.http.client.protocol.RequestProxyAuthentication] Proxy auth state: UNCHALLENGED
14:23:25.333 [DEBUG] [org.apache.http.impl.client.SystemDefaultHttpClient] Attempt 1 to execute request
14:23:25.334 [DEBUG] [org.apache.http.impl.conn.DefaultClientConnection] Sending request: HEAD /foobar/repo/master/releases/com/foobar/myartifact/0.0.1/mylib-0.0.1.pom HTTP/1.1
14:23:25.336 [DEBUG] [org.apache.http.headers] >> HEAD /foobar/repo/master/releases/com/foobar/myartifact/0.0.1/mylib-0.0.1.pom HTTP/1.1
14:23:25.336 [DEBUG] [org.apache.http.headers] >> Accept-Encoding: gzip,deflate
14:23:25.337 [DEBUG] [org.apache.http.headers] >> Host: raw.githubusercontent.com
14:23:25.338 [DEBUG] [org.apache.http.headers] >> Connection: Keep-Alive
14:23:25.338 [DEBUG] [org.apache.http.headers] >> User-Agent: Gradle/1.12 (Mac OS X;10.9.2;x86_64) (Oracle Corporation;1.7.0_45;24.45-b08)
14:23:25.464 [DEBUG] [org.apache.http.impl.conn.DefaultClientConnection] Receiving response: HTTP/1.1 404 Not Found
14:23:25.464 [DEBUG] [org.apache.http.headers] << HTTP/1.1 404 Not Found
14:23:25.465 [DEBUG] [org.apache.http.headers] << Date: Thu, 15 May 2014 20:23:25 GMT
14:23:25.465 [DEBUG] [org.apache.http.headers] << Server: Apache
14:23:25.466 [DEBUG] [org.apache.http.headers] << Content-Security-Policy: default-src 'none'
14:23:25.466 [DEBUG] [org.apache.http.headers] << Access-Control-Allow-Origin: https://render.githubusercontent.com
14:23:25.467 [DEBUG] [org.apache.http.headers] << X-XSS-Protection: 1; mode=block
14:23:25.467 [DEBUG] [org.apache.http.headers] << X-Frame-Options: deny
14:23:25.468 [DEBUG] [org.apache.http.headers] << X-Content-Type-Options: nosniff
14:23:25.468 [DEBUG] [org.apache.http.headers] << Strict-Transport-Security: max-age=31536000
14:23:25.469 [DEBUG] [org.apache.http.headers] << Content-Length: 9
14:23:25.469 [DEBUG] [org.apache.http.headers] << Accept-Ranges: bytes
14:23:25.470 [DEBUG] [org.apache.http.headers] << Via: 1.1 varnish
14:23:25.470 [DEBUG] [org.apache.http.headers] << X-Served-By: cache-sv95-SJC3
14:23:25.471 [DEBUG] [org.apache.http.headers] << X-Cache: MISS
14:23:25.471 [DEBUG] [org.apache.http.headers] << X-Cache-Hits: 0
14:23:25.472 [DEBUG] [org.apache.http.headers] << Vary: Authorization,Accept-Encoding
14:23:25.472 [DEBUG] [org.apache.http.headers] << Expires: Thu, 15 May 2014 20:28:25 GMT
14:23:25.472 [DEBUG] [org.apache.http.headers] << Source-Age: 0
14:23:25.473 [DEBUG] [org.apache.http.headers] << Keep-Alive: timeout=10, max=50
14:23:25.473 [DEBUG] [org.apache.http.headers] << Connection: Keep-Alive

```

Just to be clear, even tho its showing 404 Not Found, the file really is there. I can curl it with my credentials and it pulls down fine:

```gradle
curl -u myusername https://raw.githubusercontent.com/foobar/repo/master/releases/com/foobar/myartifact/0.0.1/mylib-0.0.1.pom

```

I think the problem is that gradle isn’t sending auth info for HTTP HEAD, and github returns 404 Not Found when it doesn’t get auth for private repos.

---

<div class="post-metadata">

**Author:** ![paleozogt](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/paleozogt/32/104_2.png) [@paleozogt](https://discuss.gradle.org/u/paleozogt)\
**Post date:** [May 15, 2014, 8:41pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/5 "2014-05-15T20:41:00Z")

</div>

More digging: [Why am I getting a 404 error on a repository that exists?](https://developer.github.com/v3/troubleshooting/#why-am-i-getting-a-404-error-on-a-repository-that-exists)

---

<div class="post-metadata">

**Author:** ![luke\_daley](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/luke_daley/32/9890_2.png) [@luke\_daley](https://discuss.gradle.org/u/luke_daley)\
**Post date:** [May 19, 2014, 4:01am UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/6 "2014-05-19T04:01:00Z")

</div>

Hi,

Thanks for your digging.

What we probably should be doing is preemptively authenticating. I’m going to ask some of the other developers to comment on this.

Would you be interested in helping to add preemptive auth support?

---

<div class="post-metadata">

**Author:** ![paleozogt](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/paleozogt/32/104_2.png) [@paleozogt](https://discuss.gradle.org/u/paleozogt)\
**Post date:** [May 19, 2014, 3:20pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/7 "2014-05-19T15:20:00Z")

</div>

Hm, it seems like this was done on purpose (!):

[http://www.gradle.org/docs/1.1/release-notes#dependency-resolution-supports-http-digest-authentication](http://www.gradle.org/docs/1.1/release-notes#dependency-resolution-supports-http-digest-authentication) It’s not a bug, its a feature! And it looks like its been causing problems for others, like GRADLE-2968.

As much as I’d like to, this probably isn’t as simple as me diving in and “fixing it”, as there’s some reason this behavior is in Gradle that I don’t have visibility into.

---

<div class="post-metadata">

**Author:** ![paleozogt](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/paleozogt/32/104_2.png) [@paleozogt](https://discuss.gradle.org/u/paleozogt)\
**Post date:** [May 19, 2014, 3:30pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/8 "2014-05-19T15:30:00Z")

</div>

From what I can gather, the best practice is to not send auth info if you don’t have to. I suspect that Gradle (or the http client lib its using) is expecting a 401 challenge-response, and the 404 is throwing it off.

I can see a couple ways of handling this problem:

1. Turn pre-emptive auth back on (probably not happening)

2. Have gradle consider a 404 equivalent to a 401. ie, if it gets a 404, it will retry the GET/HEAD with an auth

3. Add a flag to the gradle dsl to turn pre-emptive auth on, something like this:

```gradle
maven {
     credentials {
        username "${GITHUB_USERNAME}"
        password "${GITHUB_PASSWORD}"
        preemptive true
    }
    url "https://raw.githubusercontent.com/foobar/repo/master/releases"
}

```

---

<div class="post-metadata">

**Author:** ![luke\_daley](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/luke_daley/32/9890_2.png) [@luke\_daley](https://discuss.gradle.org/u/luke_daley)\
**Post date:** [May 20, 2014, 12:08am UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/9 "2014-05-20T00:08:00Z")

</div>

I’d say we’ll go with option #2 there.

---

<div class="post-metadata">

**Author:** ![Adam\_Swift](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/adam_swift/32/1483_2.png) [@Adam\_Swift](https://discuss.gradle.org/u/Adam_Swift)\
**Post date:** [September 3, 2014, 6:04pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/10 "2014-09-03T18:04:00Z")

</div>

Did something change with this in Gradle 2? While this was working with 1.12 when I try to run a build where it will need to fetch a resource from GH in this way the build fails instead. I didn’t notice anything in the release notes and there aren’t any additional comments on the linked ticket.

---

<div class="post-metadata">

**Author:** ![paleozogt](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/paleozogt/32/104_2.png) [@paleozogt](https://discuss.gradle.org/u/paleozogt)\
**Post date:** [November 3, 2014, 4:26pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/11 "2014-11-03T16:26:00Z")

</div>

Can we please get some movement on this? I can’t simply go in and unilaterally change this behavior-- gradle removed it for some reason and the devs need to discuss the options.

---

<div class="post-metadata">

**Author:** ![Bodo](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/bodo/32/1513_2.png) [@Bodo](https://discuss.gradle.org/u/Bodo)\
**Post date:** [November 4, 2014, 9:02pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/12 "2014-11-04T21:02:00Z")

</div>

i also prefer option 3, because i´m using jenkins with maven repository plugin. if jenkins is secured and auth is not send, it returns 403 (forbidden). so not to forget or add each status code the flag “preemptive” is the best solution and please add it to one of the next versions!

---

<div class="post-metadata">

**Author:** ![Ryan\_Harter](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/ryan_harter/32/1351_2.png) [@Ryan\_Harter](https://discuss.gradle.org/u/Ryan_Harter)\
**Post date:** [December 23, 2014, 12:16am UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/13 "2014-12-23T00:16:00Z")

</div>

I’m working on a gradle plugin to allow users to easily use a git repo as a maven repository, but I need this fixed in order for it to work. I’ll start diving into the source when I can to look into it, but it maybe a little while before I have time.

---

<div class="post-metadata">

**Author:** ![Marcus\_Smith](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/marcus_smith/32/277_2.png) [@Marcus\_Smith](https://discuss.gradle.org/u/Marcus_Smith)\
**Post date:** [February 16, 2015, 1:28pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/14 "2015-02-16T13:28:00Z")

</div>

did you ever resolve this?

---

<div class="post-metadata">

**Author:** ![Ryan\_Harter](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/ryan_harter/32/1351_2.png) [@Ryan\_Harter](https://discuss.gradle.org/u/Ryan_Harter)\
**Post date:** [February 16, 2015, 1:50pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/15 "2015-02-16T13:50:00Z")

</div>

The pull request is just waiting to be reviewed by a member of the gradle team (has been for almost a month). I’m using it personally with a custom build, but someone from Gradleware has to approve it before it makes it into the main project.

---

<div class="post-metadata">

**Author:** ![Marcus\_Smith](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/marcus_smith/32/277_2.png) [@Marcus\_Smith](https://discuss.gradle.org/u/Marcus_Smith)\
**Post date:** [February 16, 2015, 2:01pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/16 "2015-02-16T14:01:00Z")

</div>

So does this work with gradle 2.x and private repos? We cannot access our private repo with Gradle 2.x using https://:@ … format or by using the credentials {} within the repo definition. We would like to upgrade gradle (and our ide’s) but we cannot atm.

---

<div class="post-metadata">

**Author:** ![Ryan\_Harter](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/ryan_harter/32/1351_2.png) [@Ryan\_Harter](https://discuss.gradle.org/u/Ryan_Harter)\
**Post date:** [February 16, 2015, 2:07pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/17 "2015-02-16T14:07:00Z")

</div>

Yeah, You can check out the pull request here: [https://github.com/gradle/gradle/pull/386](https://github.com/gradle/gradle/pull/386)

Check out the diff and you can see how to implement a build of that branch to read from private github repos.

---

<div class="post-metadata">

**Author:** ![Marcus\_Smith](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/marcus_smith/32/277_2.png) [@Marcus\_Smith](https://discuss.gradle.org/u/Marcus_Smith)\
**Post date:** [February 16, 2015, 2:14pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/18 "2015-02-16T14:14:00Z")

</div>

Ok thanks for the link - I will take a look 🙂

---

<div class="post-metadata">

**Author:** ![Marcus\_Smith](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/marcus_smith/32/277_2.png) [@Marcus\_Smith](https://discuss.gradle.org/u/Marcus_Smith)\
**Post date:** [February 23, 2015, 11:24am UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/19 "2015-02-23T11:24:00Z")

</div>

Hi Ryan,

Have you tried to use this version of gradle with Android Studio at all?

Thanks,

Marcus

---

<div class="post-metadata">

**Author:** ![Ryan\_Harter](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/ryan_harter/32/1351_2.png) [@Ryan\_Harter](https://discuss.gradle.org/u/Ryan_Harter)\
**Post date:** [February 23, 2015, 3:18pm UTC](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542/20 "2015-02-23T15:18:00Z")

</div>

Hey Marcus, I have, though I don’t use anything in AS to call uploadArchives, that happens from the command line. That being said, all AS is doing is calling the same Gradle as the command line, so it should work from the Gradle pane on the right.

[Next page](https://discuss.gradle.org/t/maven-username-password-only-works-when-embedded-in-url-for-some-servers/2542.md?page=2)