If a user tries git commands pointed at an http://gitlab.example.com
address (and they have not connected to this domain before), the gitlab.example.com
server redirects (or rewrites) to https://gitlab.example.com
(note the s) and requires a correct username and password.
What information has the user sent in the clear? Has the user compromised their, username, password or project files and data?
E.g.
git remote add origin http://gitlab.example.com/namespace/projectname.git
git push https://gitlab.example.com/namespace/projectname.git
git clone http://gitlab.example.com/namespace/projectname.git
- When they have connected at least once to this domain:
git checkout -b feature1
git push master