waterWang opened a new pull request, #70641:
URL: https://github.com/apache/airflow/pull/70641
### Summary
`HttpAsyncHook` forwards Connection `extra` headers (e.g. `X-API-Key`,
`Private-Token`) across cross-host redirects because `aiohttp` only strips the
`Authorization` header. This is a security issue — a secret held under any
other header name is replayed verbatim to the redirect target.
PR #70000 fixed the synchronous `HttpHook` by subclassing `requests.Session`
and extending `rebuild_auth`. This PR fixes the async side.
### Approach
`aiohttp` has no per-redirect callback equivalent to
`requests.Session.rebuild_auth()`, so the fix disables automatic redirect
following (`allow_redirects=False`) and walks the redirect chain manually. When
the redirect target changes host, connection-supplied headers are dropped from
subsequent requests. Same-host redirects are unaffected.
### Changes
1. **`providers/http/src/airflow/providers/http/hooks/http.py`** —
`AsyncHttpSession.run()` now handles redirects manually:
- Tracks which headers originated from the connection
- Disables `aiohttp`'s auto-redirect
- On cross-host redirect: drops connection headers, keeps caller-supplied
headers
- On same-host redirect: retains all headers
- Max 5 redirects followed (matching `requests` default)
2. **`devel-common/src/tests_common/test_utils/aiohttp.py`** — Added
`headers` and `release()` to `MockAiohttpClientResponse` to support redirect
tests.
3. **`providers/http/tests/unit/http/hooks/test_http.py`** — Added
`test_async_connection_header_is_only_forwarded_on_a_same_host_redirect`
parametrized for cross-host and same-host redirects.
### Verification
- Cross-host redirect: `X-API-Key` present on first request, absent on second
- Same-host redirect: `X-API-Key` present on both requests
- Existing tests pass unchanged
### Related
- Fixes #70164
- Sync hook fix: #70000
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
