Revanth14 commented on code in PR #2098:
URL: https://github.com/apache/iceberg-go/pull/2098#discussion_r4211001620
##########
catalog/rest/rest.go:
##########
@@ -262,12 +273,22 @@ func defaultedPort(u *url.URL) string {
}
func (s *sessionTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+ // net/http strips Authorization on redirect only for a new hostname (a
+ // port or scheme change, or a hop to a subdomain, keeps it), but this
+ // runs after that stripping, so credentials and user-supplied headers
are
+ // only applied for the configured origins.
+ toCatalog := s.catalogOrigin == nil || sameOrigin(s.catalogOrigin,
r.URL)
Review Comment:
Agreed, done. `toCatalog` is now `s.catalogOrigin != nil &&
sameOrigin(...)`, so a hand-built or zero-value `sessionTransport` adds no auth
header, signature or user-supplied defaults.
`TestSessionTransportNilCatalogOriginTrustsNothing` covers it. The hand-built
fixtures in the transport and metrics-reporter tests now set the origin they
actually send to.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
