Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[HttpClient] relax auth bearer format requirements #38647

Merged
merged 1 commit into from Oct 24, 2020
Merged

[HttpClient] relax auth bearer format requirements #38647

merged 1 commit into from Oct 24, 2020

Conversation

xabbuh
Copy link
Member

@xabbuh xabbuh commented Oct 20, 2020

Q A
Branch? 4.4
Bug fix? yes
New feature? no
Deprecations? no
Tickets Fix #38609
License MIT
Doc PR

@xabbuh xabbuh added this to the 4.4 milestone Oct 20, 2020
@xabbuh xabbuh mentioned this pull request Oct 20, 2020
Closed
@xabbuh xabbuh force-pushed the issue-38609 branch 2 times, most recently from 8b0b581 to 45ea1c5 Compare October 20, 2020 13:53
@wouterj
Copy link
Member

wouterj commented Oct 20, 2020 •
edited

I just found #30561 (which introduced this regex) :

Better be sure CR/LF/etc cannot be passed inside raw header values, opening potential security risks.

Should we still check for these characters, to make sure they are not inside the bearer?

@nicolas-grekas
Copy link
Member

Thank you @xabbuh.

@nicolas-grekas nicolas-grekas merged commit 4abbb1d into symfony:4.4 Oct 24, 2020
@xabbuh xabbuh deleted the issue-38609 branch October 24, 2020 12:01
This was referenced Oct 28, 2020
Merged
Merged
Merged
@nicolas-grekas nicolas-grekas mentioned this pull request Feb 4, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nicolas-grekas nicolas-grekas nicolas-grekas approved these changes

@ro0NL ro0NL ro0NL left review comments

@chalasr chalasr chalasr left review comments

Assignees
No one assigned
Labels
Bug HttpClient Status: Reviewed
Projects
None yet
Milestone
4.4
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@xabbuh @wouterj @nicolas-grekas @ro0NL @chalasr @carsonbot