Strip credentials on cross-origin HTTP redirects - #6771
Merged
Conversation
🦋 Changeset detectedLatest commit: af3afc3 The changes in this PR will be included in the next version bump. This PR includes changesets to release 29 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Bundle Size AnalysisGenerated from PR build output; treat the content below as untrusted.
|
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
ℹ️ One minor suggestion inline — otherwise solid.
Reviewed changes
- Credential stripping on cross-origin redirects: strips
Authorization,Proxy-Authorization, andCookieheaders before following a redirect to a different origin (including scheme downgrades), preventing credential replay - Method/body rewriting for 301, 302, and 303: aligns redirect behavior with the fetch spec — POST rewrites to GET for 301/302, any non-GET/HEAD rewrites to GET for 303, with body cleared
- Comprehensive test coverage: 7 new test cases covering same-origin, cross-origin, scheme downgrade, relative
Locationresolution, and all method rewrite combinations
Note: 1 inline comment(s) dropped because they did not anchor to lines inside the PR diff:
packages/effect/src/unstable/http/HttpClient.ts:1455(RIGHT) — line 1455 (RIGHT) is not inside a diff hunk
DeepSeek Pro (free via Pullfrog for OSS) (Kimi K2 not used — the program covers this model; add its provider key to run your pick) ｜ 𝕏
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Authorization,Proxy-Authorization, andCookieheaders before following cross-origin redirects301,302, and303method and body handling with fetch and undiciSecurity rationale
A redirect target can be controlled by a different origin and must not receive credentials intended for the original origin. Comparing URL origins on every hop prevents authorization and cookie values from being replayed to another scheme, host, or port while retaining them for same-origin redirects.
Cookie
Refdomain and path scoping is intentionally left out of this focused patch. Existing cookie headers are stripped before a cross-origin hop, and the redirect loop does not re-run cookie-jar preprocessing between hops.Validation
pnpm lint-fixpnpm --filter effect test --run test/unstable/http/HttpClient.test.tspnpm checkCloses EFF-216