abhinav-phi commented on PR #2126: URL: https://github.com/apache/stormcrawler/pull/2126#issuecomment-5606425723
Both gaps addressed in 9a7a1281 (rebased onto current main): 1. Hostname verification disabled: credentialsAllowed now requires http.verify.hostnames. Pinned by credentialsAreWithheldWhenHostnameVerificationIsDisabled (+ insecure-allowed counterpart). 2. HTTPS->HTTP redirects: added a network interceptor enforcing the policy on every hop (initial request was already filtered; OkHttp auto-follow copies headers without re-checking). Proxy-Authorization excluded (authenticates against the proxy, like proxyAuthenticator). Pinned by credentialsAreStrippedOnHttpsToHttpRedirect (302 HTTPS->HTTP, trust injected without flipping the policy so initial sends while target must not) and the insecure-allowed forwarding counterpart. Also added coverage for validated-HTTPS decision (credentialsAllowedDecision matrix) and per-request metadata headers (withheld/sent). All 21 OkHttpTrustEverythingTest green locally; format/checkstyle clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
