Skip to content

http: clear digest nonce on cross-orgin redirect#21359

Closed
bagder wants to merge 5 commits into
masterfrom
bagder/1966
Closed

http: clear digest nonce on cross-orgin redirect#21359
bagder wants to merge 5 commits into
masterfrom
bagder/1966

Conversation

@bagder
Copy link
Copy Markdown
Member

@bagder bagder commented Apr 17, 2026

Verify in test 1966

Reported-by: Yalguun Tumenkhuu

Verify in test 1966

Reported-by: Yalguun Tumenkhuu
@bagder bagder marked this pull request as ready for review April 17, 2026 16:05
@bagder bagder requested a review from Copilot April 17, 2026 16:05
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to prevent HTTP Digest authentication state (nonce/challenge) from being reused across cross-origin redirects, and adds a regression test to verify the expected behavior.

Changes:

  • Add test1966 covering digest auth with netrc credentials and redirect to a different origin.
  • Register the new test in the tests/data Makefile.
  • Update redirect-follow logic to clear Digest nonce when redirecting to a different origin.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
tests/data/test1966 New regression test for digest auth + cross-origin redirect behavior
tests/data/Makefile.am Adds test1966 to the test suite list
lib/http.c Clears Digest state on cross-origin redirect during Curl_http_follow()

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread lib/http.c Outdated
Comment thread tests/data/test1966 Outdated
bagder and others added 2 commits April 17, 2026 18:11
better cleanup

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@bagder bagder closed this in 6daf4bc Apr 17, 2026
@bagder bagder deleted the bagder/1966 branch April 17, 2026 20:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

2 participants