AHC v2.16.1 Release

Security

• GHSA-3wp9-xfwm-rjjf - WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
• GHSA-7grg-jcf7-rpmx - Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
• GHSA-cf59-3jcr-vfhw - Resumable download index store is created world-readable and follows a planted symlink
• GHSA-f8m2-889x-vw4x - Client-wide realm credentials re-sent to a cross-origin redirect target
• GHSA-f9m8-cv68-674w - Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
• GHSA-jmqq-x5g9-9p2w - Replay to a different host sends the original host request and credentials to the new host
• GHSA-mfj3-87qq-382v - Digest authentication cnonce generated with a non-cryptographic random source
• GHSA-qpfv-56x8-xgx4 - URL userinfo credentials sent to the HTTP proxy in the request line
• GHSA-rqf5-2wxv-rjf4 - Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
• GHSA-rwhr-j9rv-85f8 - WebSocket handshake continues after a failed Sec-WebSocket-Accept check
• GHSA-v9f2-7rw2-gr2x - Origin credentials sent in cleartext to a proxy that rejects the CONNECT
• GHSA-vvp4-63h8-v5pm - Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
• GHSA-x5w6-vm3f-pp6f - SOCKS proxy credentials sent to the origin server over plaintext HTTP
• GHSA-xr57-gcx8-52hf - Origin credentials sent to the proxy on the plaintext CONNECT request

Behaviour changes

• A Digest challenge carrying no nonce now selects Digest rather than Basic. Such an exchange previously appeared to work because the client answered in Basic, and it will now fail. It was sending the password in the clear.
• NTLM and Negotiate connections are pooled per principal, so an application authenticating as several identities against one host holds more connections than before.
• A cookie whose Domain names a public suffix is refused. A host whose own name is a public suffix, such as the short names Docker Compose and Kubernetes hand out, can still set a cookie for itself.
• A ResponseFilter that replays onto a different host no longer carries the first origin's realm to the new one. A client-wide realm no longer follows a cross-host replay.