In Maven settings.xml, mirrorOf names the repository IDs a mirror replaces. A value of star sends everything to one repository, external:star skips localhost and file repositories, and a leading exclusion such as star,!repo1 carves out exceptions. Whitespace matters: a space after a comma can make the rule match nothing.
Where mirrors live
Mirrors are declared in settings.xml, by default under the user's .m2 directory. Each needs an id, a url and a mirrorOf:
<mirrors>
<mirror>
<id>internal-repository</id>
<name>Repository manager</name>
<url>https://repo.example.com/proxy</url>
<mirrorOf>external:*,!foo</mirrorOf>
</mirror>
<mirror>
<id>foo-repository</id>
<name>Foo</name>
<url>https://repo.example.com/foo</url>
<mirrorOf>foo</mirrorOf>
</mirror>
</mirrors>
The values
The Maven mirror guide lists these:
- A star matches all repository IDs.
- external:star matches everything except repositories on localhost or file based ones, usually to keep integration test repositories out.
- external:http:star, available since Maven 3.8.0, matches all HTTP repositories except localhost.
- A comma separates several IDs, as in repo,repo1.
- An exclamation mark with a wildcard excludes an ID, as in star,!repo1.
The whitespace trap
The guide is explicit that whitespace matters. !repo1, * mirrors nothing, while !repo1,* mirrors everything except repo1. A formatting tool or a careless edit that adds a space can silently turn off your mirror, and builds go straight to the original repositories.
After any edit, run a build with network access to the public repository blocked and confirm it still resolves through your proxy.
Which mirror wins
Maven first looks for a mirror whose mirrorOf exactly matches the repository ID. If none matches exactly, it uses the first declared mirror that fits the wildcard rules. Order therefore matters with advanced syntax. Explicit includes and excludes win over wildcard matches, so their position does not matter.
The one mirror limit
A repository can have at most one mirror. Maven does not combine mirrors with the same mirrorOf. If you want one combined view of several repositories, use a repository manager and mirror to that.
Why use a wildcard mirror for security
A wildcard mirror pointing at a repository manager gives you a single choke point. Every artifact comes through one place that you can log, scan and restrict. Note the guide's remark that the target must contain all desired artifacts or be able to proxy requests to other repositories.
Also note the guide's statement that mirroring the entire Central repository is not allowed. Use a repository manager as a proxy instead.
For related ownership checks, see Maven groupId ownership and namespace verification.
Safeguard dependency and SBOM scanning can list the artifacts a Maven build resolves and flag known vulnerabilities. You can try a free scan at gold.safeguard.sh/scan.
Quick check
What does external:star mean?
It matches all repositories except those on localhost or using file based URLs.
Can two mirrors cover the same repository?
No. Maven picks one. Use a repository manager to present several sources as one.
Sources
Last reviewed: 19 October 2026.
