dxbjavid commented on code in PR #848:
URL:
https://github.com/apache/httpcomponents-client/pull/848#discussion_r3593069457
##########
httpclient5/src/main/java/org/apache/hc/client5/http/impl/DefaultRedirectStrategy.java:
##########
@@ -111,6 +111,9 @@ private boolean isSameAuthority(final HttpHost h1, final
HttpHost h2) {
if (h1 == null || h2 == null) {
return false;
}
+ if (!h1.getSchemeName().equalsIgnoreCase(h2.getSchemeName())) {
Review Comment:
in practice you're right that a port is normally bound to a single listener,
so the same host and port serving both schemes at once is unusual. the concern
isn't that the server offers both though, it's that the redirect names the next
hop as cleartext: on https://host:8443 to http://host:8443 the client opens a
plaintext connection and writes the authorization and cookie headers before any
tls, so credentials tied to the secure origin go out in the clear. host and
port alone can't tell us that, the scheme can. that's also the rationale for
the origin framing (scheme, host, port per rfc 6454) rather than authority,
since forwarding those headers is really an origin decision. it doesn't reject
the redirect, only strips the sensitive headers, the same as a differing host
or port already does.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
