rootvector2 opened a new pull request, #3624: URL: https://github.com/apache/cxf/pull/3624
`HTTPConduit.checkAllowedRedirectUri` enforces `http.redirect.allowed.uri` with a plain `newURL.startsWith(allowedRedirectURI)`, so with the allowed value `https://api.example.com` a server can answer `302` with `Location: https://[email protected]/` (or `https://api.example.com.evil.example/`) and the conduit follows it, re-applying the configured `AuthorizationPolicy` so Basic credentials are sent to the other host. Found while reviewing the conduit redirect checks, and the new `HTTPConduitAllowedRedirectUriTest` reproduces it with two local servers. The prefix check now also requires the redirect URI's authority to equal the allowed URI's authority. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
