-
Notifications
You must be signed in to change notification settings - Fork 117
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Disable authentications on redirections #207
Conversation
I don't think we should introduce this change without a way to override it since this is a breaking change, but I generally agree with the change. Could you add another parameter to PrepareRequest to control this (and propogate it back where it gets called in httpclient)? It can probably just be an extra requestOption in the constructor |
Thanks for the response. Edit: See my next comment. |
After more thoughts, I concluded that from user's perspective it would be much simpler to add an optional boolean Changes in the last commit:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks great, thanks for doing this!
Was a CVE ever issued for this vulnerability? |
I've reported this upstream to MSRC to get a CVE issued. |
I've requested a CVE number from MITRE as I received the following from Microsoft:
|
This PR fixes a security issue.
Current behavior
BasicCredentialHandler
,BearerCredentialHandler
orPersonalAccessTokenCredentialHandler
.Authorization
header.Expected behavior
3. The next request will NOT set the
Authorization
header.See the same issue for CURL: