The GitHub Actions job "Java CI with Maven" on 
stormcrawler.git/issue-2079-okhttp-trust-v2 has succeeded.
Run started by GitHub user abhinav-phi (triggered by rzo1).

Head commit for run:
a5d7ba150d221fcff1636069ac9c502398ebb8b7 / abhinav-phi <[email protected]>
Withhold credentials from every unauthenticated server (#2079)

Review feedback on #2126:

- the decision to send credentials is now made per request: a server is
  only authenticated when the connection is https:// and the certificate
  chain is validated. Cleartext http:// requests never authenticate the
  server and no longer receive the Authorization header, credential
  headers or cookies, closing the cleartext case the first commit
  missed
- the credential header denylist is configurable with
  http.credentials.headers (default: authorization, proxy-authorization,
  cookie, x-api-key), so site-specific names like x-auth-token can be
  covered without dropping every custom header
- the withheld-cookies warning only fires when a cookie was actually
  going to be sent, and the withheld-request-headers warning is logged
  once per protocol instance instead of once per header per request
- the proxy authenticator keeps its credentials by design and says so
  in a comment: the proxy is not the crawled server
- the keytool commands that generated the test keystores are recorded
  in the test class, and the TLS test server moved to WireMock so the
  forbiddenapis check passes

Report URL: https://github.com/apache/stormcrawler/actions/runs/34148183427

With regards,
GitHub Actions via GitBox

Reply via email to