Repository: All-Hands-AI/OpenHands
File: openhands/integrations/provider.py (Python)

Code before:
            Authenticated git URL if credentials are available, otherwise regular HTTPS URL
        """
        try:
            repository = await self.verify_repo_provider(
                repo_name, is_optional=is_optional
            )
        except AuthenticationError:
            raise Exception('Git provider authentication issue when getting remote URL')

        provider = repository.git_provider
        repo_name = repository.full_name

        domain = self.PROVIDER_DOMAINS[provider]

        # If provider tokens are provided, use the host from the token if available
        # Note: For Azure DevOps, don't use the host field as it may contain org/project path
        if self.provider_tokens and provider in self.provider_tokens:
            if provider != ProviderType.AZURE_DEVOPS:
                domain = self.provider_tokens[provider].host or domain

        # Detect protocol before normalizing domain
        # Default to https, but preserve http if explicitly specified
        protocol = 'https'
        if domain and domain.strip().startswith('http://'):
            # Check if insecure HTTP access is allowed
            allow_insecure = os.environ.get('ALLOW_INSECURE_GIT_ACCESS', '').lower()
            if allow_insecure != 'true':
                raise Exception(
                    'Attempting to connect to an insecure git repository over HTTP. '
                    "If you'd like to allow this nonetheless, set "
                    'ALLOW_INSECURE_GIT_ACCESS=true as an environment variable.'
                )
            protocol = 'http'

        # Normalize domain to prevent double protocols or path segments
        if domain:
            domain = domain.strip()
            domain = domain.replace('https://', '').replace('http://', '')
            # Remove any trailing path like /api/v3 or /api/v4
            if '/' in domain:
                domain = domain.split('/')[0]

        # Try to use token if available, otherwise use public URL
        if self.provider_tokens and provider in self.provider_tokens:
            git_token = self.provider_tokens[provider].token
            if git_token:
                token_value = git_token.get_secret_value()
                if provider == ProviderType.GITLAB:
                    remote_url = (
                        f'{protocol}://oauth2:{token_value}@{domain}/{repo_name}.git'
                    )

Review comment (suggestion):
```suggestion
            allow_insecure = bool(os.environ.get('ALLOW_INSECURE_GIT_ACCESS', False))
```

Code after:
            Authenticated git URL if credentials are available, otherwise regular HTTPS URL
        """
        try:
            repository = await self.verify_repo_provider(
                repo_name, is_optional=is_optional
            )
        except AuthenticationError:
            raise Exception('Git provider authentication issue when getting remote URL')

        provider = repository.git_provider
        repo_name = repository.full_name

        domain = self.PROVIDER_DOMAINS[provider]

        # If provider tokens are provided, use the host from the token if available
        # Note: For Azure DevOps, don't use the host field as it may contain org/project path
        if self.provider_tokens and provider in self.provider_tokens:
            if provider != ProviderType.AZURE_DEVOPS:
                domain = self.provider_tokens[provider].host or domain

        # Detect protocol before normalizing domain
        # Default to https, but preserve http if explicitly specified
        protocol = 'https'
        if domain and domain.strip().startswith('http://'):
            # Check if insecure HTTP access is allowed
            allow_insecure = os.environ.get(
                'ALLOW_INSECURE_GIT_ACCESS', 'false'
            ).lower() in ('true', '1', 'yes')
            if not allow_insecure:
                raise ValueError(
                    'Attempting to connect to an insecure git repository over HTTP. '
                    "If you'd like to allow this nonetheless, set "
                    'ALLOW_INSECURE_GIT_ACCESS=true as an environment variable.'
                )
            protocol = 'http'

        # Normalize domain to prevent double protocols or path segments
        if domain:
            domain = domain.strip()
            domain = domain.replace('https://', '').replace('http://', '')
            # Remove any trailing path like /api/v3 or /api/v4
            if '/' in domain:
                domain = domain.split('/')[0]

        # Try to use token if available, otherwise use public URL
        if self.provider_tokens and provider in self.provider_tokens:
            git_token = self.provider_tokens[provider].token
            if git_token:
                token_value = git_token.get_secret_value()
                if provider == ProviderType.GITLAB:
                    remote_url = (