Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Specify CheckRedirect function in http.send client #5388

Closed
ashutosh-narkar opened this issue Nov 15, 2022 · 0 comments · Fixed by #5546
Closed

Specify CheckRedirect function in http.send client #5388

ashutosh-narkar opened this issue Nov 15, 2022 · 0 comments · Fixed by #5546
Labels
feature-request
Projects
Open Policy Agent

Comments

@ashutosh-narkar
Copy link
Member

The http client used in the http.send built-in does not specify the CheckRedirect field during the initialization of http.Client struct. If http redirects are disabled, CheckRedirect returns ErrUseLastResponse. It would good to have the CheckRedirect validate the redirect URLs returned by the server when http redirects are enabled.
@ashutosh-narkar ashutosh-narkar added this to Backlog in Open Policy Agent via automation Nov 15, 2022
ashutosh-narkar added a commit to ashutosh-narkar/opa that referenced this issue Jan 5, 2023
@ashutosh-narkar
topdown: Specify host verification policy for http redirects
7e6cf91 
Currently if http redirects are enabled, we use the client's default
redirect policy. We should instead check if the hosts http.send
calls as part of the redirect are explictly allowed by the policy
authors. This change updates the http client's CheckRedirect policy
to verify the hosts the client calls when redirects are enabled.

Fixes: open-policy-agent#5388

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
@ashutosh-narkar ashutosh-narkar mentioned this issue Jan 5, 2023
Merged
Open Policy Agent automation moved this from Backlog to Done Jan 6, 2023
ashutosh-narkar added a commit that referenced this issue Jan 6, 2023
@ashutosh-narkar
topdown: Specify host verification policy for http redirects
eccfa95 
Currently if http redirects are enabled, we use the client's default
redirect policy. We should instead check if the hosts http.send
calls as part of the redirect are explictly allowed by the policy
authors. This change updates the http client's CheckRedirect policy
to verify the hosts the client calls when redirects are enabled.

Fixes: #5388

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
feature-request
Projects
Open Policy Agent
  
Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

topdown: Specify host verification policy for http redirects ashutosh-narkar/opa
1 participant
@ashutosh-narkar