Re: [PATCH 2/2] http: prevent redirect from dropping credentials during reauth
- From
Robert Coup <robert.coup@koordinates.com>
- Date
- Feb 5, 2024, 09:22 UTC
- Message-ID
- <CAFLLRpJn6PJndfHCR8H6uSdCSVfzHPBBQ5o5=Z1Lj_2a3XtkyA@mail.gmail.com>
- In-Reply-To
- <CYWTFH7Z8IY4.313MNLG552V8M@devyard.org>
Hi Quentin,
> I have suggested to switch to implementing the same behaviour as libcurl when it comes to reusing credentials: if the hostname of the redirect is the same as the original URL, reuse the credentials, otherwise drop them.
The protocol & port number also need to match, so it doesn't end up the same as CVE-2022-27774 [1]
Rob :)
[1] https://curl.se/docs/CVE-2022-27774.html