# LFS authentication with DISABLE\_HTTP\_GIT

**URL:** <https://forum.gitea.com/t/lfs-authentication-with-disable-http-git/2531>\
**Category:** Install/Maintain/Configure\
**Created:** [September 29, 2020, 2:40pm UTC](https://forum.gitea.com/t/lfs-authentication-with-disable-http-git/2531 "2020-09-29T14:40:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![marf](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/marf/32/4945_2.png) [@marf](https://forum.gitea.com/u/marf)\
**Post date:** [September 29, 2020, 2:40pm UTC](https://forum.gitea.com/t/lfs-authentication-with-disable-http-git/2531/1 "2020-09-29T14:40:53Z")

</div>

Hi there,

I am running gitea with DISABLE\_HTTP\_GIT as I want to restrict access to SSH only. For one of my repositories I am experimenting with Git LFS. I was surprised that the blobs of the large files are downloaded via https even though I have disabled HTTPS access by setting in app.ini `[repository] DISABLE_HTTP_GIT = true`.

Doesn’t this open security holes and allowing others to download blobs when given an URL? How are these HTTPS requests secured? Is there any authentication happening?

Best regards,  
Martin