{"id":786,"date":"2026-07-18T20:33:59","date_gmt":"2026-07-18T17:33:59","guid":{"rendered":"https:\/\/mexela.com\/blog\/git-npm-proxy-settings\/"},"modified":"2026-07-19T21:18:20","modified_gmt":"2026-07-19T18:18:20","slug":"git-npm-proxy-settings","status":"publish","type":"post","link":"https:\/\/mexela.com\/blog\/git-npm-proxy-settings\/","title":{"rendered":"Git and npm Proxy Settings: Configure, Test, and Remove Safely"},"content":{"rendered":"

Configure a Git proxy with git config --global http.proxy<\/code> and an npm proxy with npm config set proxy<\/code> plus https-proxy<\/code>, then inspect the effective value and its source before testing. Remove stale settings with the matching unset<\/code> or delete<\/code> command instead of disabling TLS.<\/p>\n

Scope:<\/strong> this tutorial covers Git smart HTTP and npm registry traffic. For application runtime clients, use the curl, Python, and Node.js proxy guide<\/a>; the Proxy Setup and Developer Guides hub<\/a> links the wider setup cluster.<\/p>\n

Inspect configuration scope before changing it<\/h2>\n

Git can read system, global, repository, environment, and URL-specific values. npm can read project, user, global, environment, and command-line configuration. A command may work in one terminal and fail in CI because the effective sources differ.<\/p>\n

git config --show-origin --get-regexp '^(http|https)[.]'\nnpm config get proxy\nnpm config get https-proxy\nnpm config get registry<\/code><\/pre>\n
Do not paste output containing a credential-bearing URL into a ticket. Record the config source, proxy host label, port, auth method, and sanitized error instead.<\/p>\n
Configure a Git proxy for HTTPS remotes<\/h2>\n
The official Git configuration documentation<\/a> defines http.proxy<\/code>, URL-specific http.<url>.*<\/code> settings, and proxy authentication methods. Start globally only when every repository needs the same route.<\/p>\n
git config --global http.proxy http:\/\/HOST:PORT\ngit config --global --get http.proxy\ngit ls-remote https:\/\/github.com\/git\/git.git HEAD<\/code><\/pre>\n
For a narrower destination, use a URL-specific section rather than routing unrelated remotes. If the proxy requires authentication, prefer a credential manager or an approved runtime prompt. A password inside .gitconfig<\/code> is readable configuration, not secret storage.<\/p>\n
Configure npm proxy and HTTPS proxy values<\/h2>\n
The official npm configuration reference<\/a> documents proxy<\/code>, https-proxy<\/code>, and the standard proxy environment variables honored by the fetch layer.<\/p>\n
npm config set proxy http:\/\/HOST:PORT\nnpm config set https-proxy http:\/\/HOST:PORT\nnpm ping<\/code><\/pre>\n
The https-proxy<\/code> value often still uses the HTTP URL scheme: that means npm connects to an HTTP proxy and asks it to tunnel the HTTPS registry connection. It does not make registry TLS optional.<\/p>\n
Use environment variables for temporary or CI scope<\/h2>\n
Temporary environment variables can keep machine-wide config unchanged, but CI secret masking and process inheritance still matter. Define only the variables the tool supports, scope them to one job, and unset them afterward.<\/p>\n
HTTP_PROXY=http:\/\/HOST:PORT\nHTTPS_PROXY=http:\/\/HOST:PORT\nNO_PROXY=localhost,127.0.0.1,.internal.example<\/code><\/pre>\n
On a shared runner, do not write credential-bearing values into echoed shell commands. Use the platform’s protected secret store and confirm redaction with a harmless placeholder before running a real job.<\/p>\n
Keep TLS verification enabled<\/h2>\n
A certificate error is not repaired by setting http.sslVerify=false<\/code> or strict-ssl=false<\/code>. Check the device clock, destination hostname, approved enterprise inspection certificate, Git\/npm trust store, and whether the proxy created a tunnel. An unknown root must be investigated and distributed through the organization’s normal trust process.<\/p>\n
Expected observation:<\/strong> Git reports the intended configuration source, git ls-remote<\/code> returns one reference, npm ping<\/code> reaches the configured HTTPS registry, and both operations keep certificate verification enabled. A 407 proves reachability to the proxy but failed authentication.<\/p>\n
Remove proxy settings from the same scope<\/h2>\n
When the route is no longer required, remove proxy settings rather than leaving an unreachable endpoint that breaks future work.<\/p>\n
git config --global --unset http.proxy\nnpm config delete proxy\nnpm config delete https-proxy<\/code><\/pre>\n
Repeat the inspection commands afterward. If a value remains, it belongs to another scope or environment variable. Search the effective sources; do not create a second contradictory value.<\/p>\n
Git and npm troubleshooting sequence<\/h2>\n
    \n
  1. Confirm the remote or registry URL and direct policy.<\/li>\n
  2. Inspect the exact source of the effective Git and npm proxy settings.<\/li>\n
  3. Resolve and reach the proxy host and port once.<\/li>\n
  4. Separate a 407 from a TLS error or destination response.<\/li>\n
  5. Compare the two tools; one success and one failure points to client configuration.<\/li>\n
  6. Remove obsolete values and repeat one bounded test.<\/li>\n<\/ol>\n
    For credential method differences, read username\/password versus IP authentication<\/a>. For timeouts, TLS, and 407 details, use the proxy error diagnostic sequence<\/a>.<\/p>\n
    Security limits:<\/strong> never commit proxy credentials to .npmrc<\/code>, .gitconfig<\/code>, repository files, lockfiles, CI logs, or images. Do not disable certificate checks to pass a build. Rotate a secret immediately if it entered version control or public logs.<\/p>\n
    Choose a stable developer egress after both clients pass<\/h2>\n
    Record the developer and CI locations, expected concurrent jobs, authentication model, and transfer volume. If those workflows need a consistent exclusive address for allowlists, compare the requirements with current private proxy options<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
    Set Git and npm proxy scopes deliberately, inspect the effective configuration, protect credentials, test TLS, and remove stale settings cleanly.<\/p>\n","protected":false},"author":0,"featured_media":787,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[189],"tags":[],"_links":{"self":[{"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/posts\/786"}],"collection":[{"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/comments?post=786"}],"version-history":[{"count":1,"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/posts\/786\/revisions"}],"predecessor-version":[{"id":795,"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/posts\/786\/revisions\/795"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/media\/787"}],"wp:attachment":[{"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/media?parent=786"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/categories?post=786"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mexela.com\/blog\/wp-json\/wp\/v2\/tags?post=786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}