v5.1.0

Promoted from v5.1.0-dev.2

This release fixes a redirect allowlist bypass that let a redirect reach a loopback or other local IPv6 address. Every v5.0.x release has it, so upgrade if you use WithAllowedSuffixes or DockerGitHubRedirectPolicy. It also adds WithSameOrigin and a typed error for refused redirects.

Security

• WithAllowedSuffixes and DockerGitHubRedirectPolicy matched an allowed suffix against the whole host string, IPv6 zone included. A redirect to https://[::1%25.docker.com]/ passed the .docker.com check and reached the loopback address. net/http forwards custom headers on a redirect, so a credential sent in one could reach that address. An allowed suffix now matches host names only, never an IP address. (#603)

Added

• WithSameOrigin(true) follows a redirect to the original host only when the scheme, host and port all match, so a credential header never reaches another port on the same host. Other hosts keep the allowlist and downgrade rules. (#590)
• Every hard redirect refusal from RedirectPolicyFunc, DefaultRedirectPolicy and DockerGitHubRedirectPolicy is now a *RedirectRefusedError, with its Origin and a Reason of RedirectNotAllowed, RedirectOtherOrigin, RedirectDowngrade or RedirectTooMany. Read it with errors.As. RefuseAllRedirects and WithPreserveMethod still return http.ErrUseLastResponse. (#590)

Changed

• Refusal messages name the target's origin instead of the bare host, for example refusing redirect to https://evil.example:8443. If your code matches on the message text, switch to errors.As. (#590)
• WithMaxHops(n) and the default cap of 5 now follow exactly n redirects and refuse the next one. Before, they followed one fewer. (#590)

Fixed

• Redirect checks compare an IPv6 zone exactly, so a redirect to fe80::1%ETH0 after a request to fe80::1%eth0 is refused as another origin. DNS host names still compare without regard to ASCII case. (#603)
• Redirect policies compare an IP address by its value, so 2001:db8::a and 2001:db8:0::a are one host, and an empty allowlist entry matches nothing. (#603)

Full changelog: v5.0.5...v5.1.0