Query parameter authentication is deprecated on GitHub

GiorgioGhisotti commented 4 years ago

Hello,

GitHub has deprecated access token authentication through query parameters. As far as I can tell this utility can't work with https authentication anymore short of asking the user for their credentials every time. Using ssh authentication could be a solution.

ConradIrwin commented 4 years ago

Are they continuing to support the Authorization: Bearer tokens?

P.S. Superhuman is hiring — referral bonus for Full Stack Engineers ( https://superhuman.com/roles?gh_jid=260350 ) : $1,947.

On Tue, Feb 04, 2020 at 5:49 AM, Giorgio Ghisotti < notifications@github.com > wrote:

Hello,

GitHub has deprecated access token authentication through query parameters ( https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/#authenticating-using-query-parameters ). As far as I can tell this utility can't work with https authentication anymore short of asking the user for their credentials every time. Using ssh authentication could be a solution.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub ( https://github.com/defunkt/gist/issues/309?email_source=notifications&email_token=AAAXAQCR5WX3I74QZGCHJZDRBFW6JA5CNFSM4KPXHQY2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4IK42RMQ ) , or unsubscribe ( https://github.com/notifications/unsubscribe-auth/AAAXAQGR444LFNFPZQNWSM3RBFW6JANCNFSM4KPXHQYQ ).

Darkle commented 4 years ago

They mention in the email to use the Authorization HTTP header instead FWIW

cmoulliard commented 4 years ago

The github email mentions the following message

Please use the Authorization HTTP header instead,
as using the `access_token` query parameter is deprecated.

Depending on your API usage, we'll be sending you this email ...

Visit 
https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/#authenticating-using-query-parameters
for more information.

The web pages explains

GitHub is deprecating authentication to the GitHub API using query parameters,
such as using a access_token query parameter for OAuth user authentication
or a client_id/client_secret query  parameter for OAuth application authentication.

All authentication to the GitHub API should be done 
using HTTP basic authentication
see: 
https://developer.github.com/v3/auth/#via-oauth-and-personal-access-tokens.

GiorgioGhisotti commented 4 years ago

As far as I can tell from the documentation, "basic authentication", even with OAuth, means that the user is queried for username and OAuth token after making the http request - there may be a way to automate that process but it feels a bit clunky and not the intended way of authenticating.