Please stop serving .git to the outside world
pythonsweetness.tumblr.com
Please stop serving .git to the outside world
1–10 of 91 posts
Re: Please stop serving .git to the outside world
#2This is a brilliant post. I was about to deploy a site before I read this. It's so easy just to forget that directory.
Re: Please stop serving .git to the outside world
#3To be clear (it wasn't mentioned explicitly in the blog post), but it's obviously what the author was referring to, this is about people who are deploying web sites with static content which is being managed via git.
Re: Please stop serving .git to the outside world
#4I think there's nothing wrong with this if there aren't (and weren't) any secrets directly embedded in the source code and all configuration files that contain sensitive information are (and always were) properly gitignore'd.
Tech-savvy users can even be encouraged to pull the code and send patches. :)
Re: Please stop serving .git to the outside world
#5I recently discovered that I had been serving .git on my blog for a couple of years. All it took to fix was a simple rule in my Nginx config:
# Don't expose hidden files to the web
location ~ /\. {
return 404;
}Re: Please stop serving .git to the outside world
#6To be clear (it wasn't mentioned explicitly in the blog post), but it's obviously what the author was referring to, this is about people who are deploying web sites with static content which is being managed via git.
And it only applies when the document root is also the git repo root. If the document root is under a subdirectory, the .git directory won't be served.
Re: Please stop serving .git to the outside world
#7I make it a habit to put all my public files in directory such as www/, where as .git and other non public but site-related files/directories are contained above this.
Re: Please stop serving .git to the outside world
#8I think there's nothing wrong with this if there aren't (and weren't) any secrets directly embedded in the source code and all configuration files that contain sensitive information are (and always were) properly gitignore'd. Tech-savvy users can even be encouraged to pull the code and send patches. :)
Somebody correct me if I'm wrong here, but doesn't the .git directory essentially contain the entire history of the repository? The history could easily contain sensitive information like passwords. It will contain names email addresses of contributors, too. Try it yourself: cat .git/logs/HEAD
Re: Please stop serving .git to the outside world
#9I think there's nothing wrong with this if there aren't (and weren't) any secrets directly embedded in the source code and all configuration files that contain sensitive information are (and always were) properly gitignore'd. Tech-savvy users can even be encouraged to pull the code and send patches. :)
Somebody correct me if I'm wrong here, but doesn't the .git directory essentially contain the entire history of the repository? The history could easily contain sensitive information like passwords. It will contain names email addresses of contributors, too. Try it yourself: cat .git/logs/HEAD
[deleted]
Re: Please stop serving .git to the outside world
#10For simple static sites, I use a workflow very similar to this one[1]. It takes a minute or two to set up, but once it's all configured, you can deploy to your heart's content without ever worrying about exposing your .git directory to the world.