gitlab

Gitlab : increase number of characters in personal access token

In Gitlab, when I read https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html, it seems that the number of characters for a personal access token is 20.

The token string must be 20 characters in length, or it will not be recognized as a personal access token.

In Github, the pat is a 40 characters token.

In my ecosystem, I have both applications and I use a proxy in order to analyze what passes through the server. I use the length of the password being transferred in order to assess whether a user is using his password or his token in order to access Git. It would be simpler for me if Gitlab could use a token with the same length as github, i.e. 40 characters instead of 20.

Is it possible to tune Gitlab so that the personal access token is longer than 20 ? My guess is probably not but someone might have found a trick.

Solution

  • The length seems fixed, according to the GitLab documentation

    That differs from GitHub which:

    (See "GitHub Authentication token format updates")

    Maybe GitLab will at some point follow suit, but for now (S1 2021), that is not the case

    Note: GitLab 14.5 (November 2021)

    New GitLab access token prefix and detection

    With GitLab 14.5 we have updated the GitLab Personal Access Tokens and Project Access Tokens to include a standard prefix, glpat- by default for both GitLab.com and GitLab self-managed instances.
    We’ve also updated our Secret Detection scanning to detect this new pattern which will help protect you against accidentally leaked GitLab access tokens in commits.

    This improvement helps make it easy to detect GitLab tokens leaked in commits and builds on community contribution improvements added in Gitlab 13.7 that allowed Admins to set Personal Access Token prefixes at the instance level, shoutout to @max-wittig and @dlouzan at Siemens for this contribution!

    Existing access tokens will not be modified but any new tokens will follow this new pattern or the custom pattern set by your self-hosted GitLab instance.

    If you would like to detect GitLab Personal Access Tokens and Project Access Tokens you can use the following regex detection pattern: glpat-[0-9a-zA-Z\-]{20}.

    https://about.gitlab.com/images/14_5/14-5-admin-token-prefix.png -- New GitLab access token prefix and detection

    See Documentation and Issue.

    As a result (Jan. 2023): "Secret Detection update: Leaked Personal Access Tokens will soon be revoked "

    GitLab will soon begin automatically revoking Personal Access Tokens (PATs) when GitLab Secret Detection finds them in public repositories, an update that will better protect GitLab users and organizations.

    Q4 2024: as noted by Nicholas Hollander in the comments:

    At some point GitLab updated their project access tokens to permit an underscore.
    I was not able to find any specific documentation for this change (in a brief search) but the regular expression used by the secrets detection service is now glpat-[0-9a-zA-Z_\-]{20} (/spec/lib/gitlab/secret_detection/core/scanner_spec.rb).