Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix: thirdparty site authorization header leak #386

Closed
wants to merge 1 commit into from
Closed

Fix: thirdparty site authorization header leak #386

wants to merge 1 commit into from

Commits on Jan 12, 2022

  1. Fix: thirdparty site authorization header leak 

    bug reported to https://huntr.dev/bounties/03ac704d-6ccf-4d4b-bed3-f123f4e31dcd/ 
When accessing a url with Authorization and if received a Location redirect header with different host then needle will follow this redirect and also send the Authorization to this thirdparty redict url .
You must prevent this Authorization header leak .
    @ranjit-git
    ranjit-git committed Jan 12, 2022
    Configuration menu
    Copy the full SHA
    77576c0 View commit details
    Browse the repository at this point in the history