401 error code, because of 2FA ?

[olvlvl]

Hi,

Earlier this week I activated Two Factor Authentication because it is required for one of our clients. Today I was editing some Markdown files and gfm_viewer was only rendering empty frames. I checked the console and it looks like GitHub replies with a 401 HTTP code "Unauthorized" to every request. Here after is the response:

Fri Sep 26 14:41:39 CEST 2014 com.sun.jersey.api.client.filter.LoggingFilter log : 1 * Client in-bound response
1 < 401
1 < Server: GitHub.com
1 < Date: Fri, 26 Sep 2014 12:41:44 GMT
1 < Content-Type: application/json; charset=utf-8
1 < Status: 401 Unauthorized
1 < X-GitHub-OTP: required; app
1 < X-GitHub-Media-Type: unknown
1 < X-RateLimit-Limit: 60
1 < X-RateLimit-Remaining: 56
1 < X-RateLimit-Reset: 1411738657
1 < X-XSS-Protection: 1; mode=block
1 < X-Frame-Options: deny
1 < Content-Security-Policy: default-src 'none'
1 < Content-Length: 160
1 < Access-Control-Allow-Credentials: true
1 < Access-Control-Expose-Headers: ETag, Link, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval
1 < Access-Control-Allow-Origin: *
1 < X-GitHub-Request-Id: 6DBE21A5:3B44:1BD942F7:54255F07
1 < Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
1 < X-Content-Type-Options: nosniff
1 < 

I used your plugin for many months now, with my username and password to pass the rate limit.

Do you think it's related to the 2FA ?

[olvlvl]

Hi,

I can confirm that it is because of the 2FA. I created another account without 2FA and the plugin works fine.

[satyagraha]

Thanks for alerting on this, and for such an accurate diagnostic investigation. On first sight, it is clear that the issue of 2FA is not trivial so I'll need to take some time to understand the implications and solution alternatives.

Your work-around of having a separate dedicated GitHub account with standard authentication is perfectly viable, and arguably even more secure since then Eclipse has no information on your main GitHub account credentials whatsoever.

[olvlvl]

That's really unfortunate, and I don't see every user creating a second account for the plugin to work properly. Maybe GitHub should require a lesser level of authentication for its Markdown API.

[paulvi]

Why to close issue? It is not solved. Keep open or mention in README

[satyagraha]

It would be good to be able to support 2FA, however the relevant docs are quite complex and give many options, which makes it hard to decide exactly what to do. @olvlvl could you you give us the typical workflow you would want to use with 2FA? I see at https://confluence.atlassian.com/sourcetreekb/two-factor-authentication-2fa-with-github-in-sourcetree-402033499.html that with their tool you can just generate a token and use it as the password. Have you tried that approach? So how might this work in Eclipse?

[olvlvl]

Hi, I closed the issue because it's not relevant to me anymore, and since it was not updated in two years, it might have been only my issue :) Besides, I moved to PhpStorm since then and its Markdown editor renders without the help of third parties.