Apache Maven 3.10 Not using credentials of server during deploys leading to 401 server response

Problem

After upgrading to Maven 3.10, attempts to publish to a secure Maven repo (e.g. Maven Central, your Nexus Repository hosted maven repo) fail with a HTTP 401 responses and WARNING in Maven build logs.

Symptoms

The Maven logs show that no credentials have been sent to the destination repo:

[WARNING] Not using credentials of server 'YourServer' for repository https://destination-host/repository/destination-repo/: 
the origins declared for this id are [https://another-host]. Add 'https://destination-host' 
to of that server in settings if these credentials belong there, or set 
maven.repository.credentialScope=id to restore legacy id-only credential matching.

Cause

Maven 3.10 introduced 'Security Hardening' measures to prevent credential leaking. 

Solution

Update your settings.xml to stipulate repositoryOrigins in your server block. For example:

  <servers>
    <server>
      <id>releases</id>
      <username>my-releases-user</username>
      <password>my-releases-password</password>
      
      <!-- Added in Maven 3.10.0+ for credential scoping -->
      <repositoryOrigins>
        <repositoryOrigin>https://central.sonatype.com</repositoryOrigin>
        <repositoryOrigin>https://repo.example.org</repositoryOrigin>
      </repositoryOrigins>
    </server>

The official 3.10 settings.xml documentation is here: https://maven.apache.org/ref/3.10.0/maven-settings/settings.html#server-1