dxbjavid commented on code in PR #848:
URL:
https://github.com/apache/httpcomponents-client/pull/848#discussion_r3576021015
##########
httpclient5/src/main/java/org/apache/hc/client5/http/impl/DefaultRedirectStrategy.java:
##########
@@ -111,6 +111,9 @@ private boolean isSameAuthority(final HttpHost h1, final
HttpHost h2) {
if (h1 == null || h2 == null) {
return false;
}
+ if (!h1.getSchemeName().equalsIgnoreCase(h2.getSchemeName())) {
Review Comment:
agreed, and that's the intent here. the scheme mismatch only marks the
origins as different, it doesn't reject the redirect on its own. an https to
http hop still goes through unless there's an authorization or cookie header to
protect, exactly as it already behaves for a differing host or port. the last
assertion in the added test covers the plain https to http redirect staying
allowed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
