authenticator: do not send credentials configured for https with http

[radoering]

Pull Request Check List

• Added tests for changed code.
• Updated documentation for changed code.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="src/poetry/utils/authenticator.py" line_range="447-449" />
<code_context>
         candidates = []

         for repository in self.configured_repositories.values():
+            if repository.scheme == "https" and parsed_url.scheme != "https":
+                # never send credentials configured for https in the clear
+                continue
+
             if exact_match:
</code_context>
<issue_to_address>
**🚨 issue (security):** When an HTTPS repository has credentials stored in the keyring under its URL or netloc, an HTTP request skips that repository and then falls through to the generic keyring lookup in `_get_credentials_for_url`, which retrieves and sends the same credentials over HTTP.

**Triggers:** When keyring credentials are stored under the repository URL or host rather than only under the repository name.

**Suggested fix:** If a non-HTTPS request shares a netloc with a configured HTTPS repository and no eligible HTTP repository matches, return empty credentials instead of performing the generic URL/netloc keyring fallback.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and this changes the credential transport trust boundary: HTTPS-configured credentials are withheld whenever the request uses HTTP. If that policy is wrong, the behavior applies immediately to all matching repositories and can cause authentication failures until reverted, while any credentials exposed before a correction cannot be recovered by the revert.

Blocking findings: src/poetry/utils/authenticator.py:449

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook