wagon-http applies the headers configured for a repository (setHttpHeaders, used by Maven for <server><configuration><httpHeaders>, and the <httpConfiguration> method headers) to every request it sends, and Apache HttpClient copies the headers of the original request onto each redirected request. When a repository answers with a redirect to a different host, port or scheme, those headers are therefore sent to the redirect target as well.
Headers configured this way are frequently credentials: a static Authorization: Bearer … or a private-repository token header. A repository that redirects downloads to a CDN or mirror, or that is itself compromised, ends up receiving them at a host the operator never configured them for. Basic authentication handled through the credentials provider is not affected, because HttpClient scopes it by host; only the configured header set is.
AbstractHttpClientWagon.setHeaders sets the headers on the request, WagonRedirectStrategy builds the redirected request and HttpClient's RedirectExec copies the headers over; nothing removes them. Both master and wagon-3.x have the same code. wagon-http-lightweight has the equivalent behaviour through HttpURLConnection.
Expected: headers configured for a repository are sent only to that repository's origin (same scheme, host and effective port); a redirect within the origin keeps them, a redirect to another origin does not. The native resolver transports were changed to behave this way in apache/maven-resolver#2085, so wagon-http should match.
This issue was created with AI assistance.
wagon-httpapplies the headers configured for a repository (setHttpHeaders, used by Maven for<server><configuration><httpHeaders>, and the<httpConfiguration>method headers) to every request it sends, and Apache HttpClient copies the headers of the original request onto each redirected request. When a repository answers with a redirect to a different host, port or scheme, those headers are therefore sent to the redirect target as well.Headers configured this way are frequently credentials: a static
Authorization: Bearer …or a private-repository token header. A repository that redirects downloads to a CDN or mirror, or that is itself compromised, ends up receiving them at a host the operator never configured them for. Basic authentication handled through the credentials provider is not affected, because HttpClient scopes it by host; only the configured header set is.AbstractHttpClientWagon.setHeaderssets the headers on the request,WagonRedirectStrategybuilds the redirected request and HttpClient'sRedirectExeccopies the headers over; nothing removes them. Bothmasterandwagon-3.xhave the same code.wagon-http-lightweighthas the equivalent behaviour throughHttpURLConnection.Expected: headers configured for a repository are sent only to that repository's origin (same scheme, host and effective port); a redirect within the origin keeps them, a redirect to another origin does not. The native resolver transports were changed to behave this way in apache/maven-resolver#2085, so
wagon-httpshould match.This issue was created with AI assistance.