Repository navigation
Conversation
WebClient copied all additional headers of a request to the redirect target, and HtmlPage copied the headers of the page request to every external script request, regardless of the target origin. Remove the Authorization header in both cases if the origin changes, like XMLHttpRequest already does for its redirects. Add Vidya m to contributors in pom.xml.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repro: set
Authorization: Bearer ...on aWebRequestforhttp://localhost:18081/and have that server answer302 Location: http://127.0.0.1:18082/, or serve a page there that contains<script src="http://127.0.0.1:18082/lib.js">. In both cases the server on 127.0.0.1:18082 receives the bearer token.Cause:
WebClient.loadWebResponseFromWebConnection()copies every additional header to the redirect request (both the 301/302/303 and the 307/308 branch), andHtmlPage.loadJavaScriptFromUrl()copies the headers of the page request to every external script request, without looking at the target origin.Fix: drop
Authorizationwhen the origin changes, with the sameUrlUtils.isSameOrigin()check thatXMLHttpRequestalready uses for its redirects (Fetch spec, HTTP-redirect fetch). Headers registered withWebClient.addRequestHeader()are still added to every request as before.WebClientTest.redirection_AuthorizationHeaderDroppedForCrossOrigincovers all five redirect codes for a same-origin and a cross-origin target, andHtmlScriptTest.authorizationHeaderNotSentToCrossOriginScriptcovers the script load. Both fail without the change. I also added myself to the contributors in pom.xml and as author of the touched files.