wt/cpp-httplib
1
0 Fork 0
mirror of https://github.com/yhirose/cpp-httplib.git synced 2026-10-17 10:59:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent forwarding of authentication credentials during cross-host redirects as per RFC 9110. Add tests for basic auth and bearer token scenarios.

Browse Source
This commit is contained in:
yhirose committed 2026-03-23 22:32:53 -04:00
1 parent cb8365349f
commit 703abbb53b
2 files changed
+64 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

httplib.h
+5 -12
View File
@@ -13048,18 +13048,11 @@ inline void ClientImpl::setup_redirect_client(ClientType &client) {
client.set_compress(compress_);
client.set_decompress(decompress_);
// Copy authentication settings BEFORE proxy setup
if (!basic_auth_username_.empty()) {
client.set_basic_auth(basic_auth_username_, basic_auth_password_);
}
if (!bearer_token_auth_token_.empty()) {
client.set_bearer_token_auth(bearer_token_auth_token_);
}
#ifdef CPPHTTPLIB_SSL_ENABLED
if (!digest_auth_username_.empty()) {
client.set_digest_auth(digest_auth_username_, digest_auth_password_);
}
#endif
// NOTE: Authentication credentials (basic auth, bearer token, digest auth)
// are intentionally NOT copied to the redirect client. Per RFC 9110 Section
// 15.4, credentials must not be forwarded when redirecting to a different
// host. This function is only called for cross-host redirects; same-host
// redirects are handled directly in ClientImpl::redirect().
// Setup proxy configuration (CRITICAL ORDER - proxy must be set
// before proxy auth)