Private repositories: cannot change username and/or password

[frederikbosch]

Beacuse the password is hardcoded in the composer remote (.git/config), the user is not able to change authentication credentials in auth.json. The only way to do this is by removing the vendor folder and run composer install again.

PR #3608 fixes this issue.

[midan888]

Wow man thanks. was looking for the solution 2 days

[AndreKR]

I was bitten by this today and I traced it back to this part:

composer/src/Composer/Util/Git.php

Lines 57 to 61 in fdcae61

	// capture username/password from URL if there is one
	$this->process->execute('git remote -v', $output, $cwd);
	if (preg_match('{^(?:composer|origin)\s+https?://(.+):(.+)@([^/]+)}im', $output, $match)) {
	$this->io->setAuthentication($match[3], rawurldecode($match[1]), rawurldecode($match[2]));
	}

For each dependency, credentials are stored once in .git/config and then will forever take precedence over any credentials set in auth.json.

I wholeheartedly agree with the comments by @frederikbosch here: https://github.com/composer/composer/pull/3608/files#r23305353

I think the current behavior is confusing, useless and dangerous. It should be removed and if it actually breaks an existing automated flow, then this flow was broken to begin with: Why would any flow rely on credentials that are secretly cached inside the dependency directory. On the other hand, removing this code would open up a much more reasonable flow: Set credentials (which can be a temporary CI token) in auth.json and use those same credentials for both installing new dependency as well as updating existing ones. (Currently the credentials from auth.json are used for new/deleted dependencies and the cached credentials are used for existing ones.)

[Seldaek]

Sorry this took so long but should be fixed in the next 1.9 release, you can run composer self-update --snapshot to try it now if you'd like to confirm the fix.

[frederikbosch]

@Seldaek No hard feelings, you guys have done awesome work with composer. You rock!