fix: strip proxy-authorization header on cross-host redirect - #196
Open
mahirhir wants to merge 1 commit into
Open
fix: strip proxy-authorization header on cross-host redirect#196mahirhir wants to merge 1 commit into
mahirhir wants to merge 1 commit into
Conversation
When a request redirects to a different hostname, minipass-fetch already drops the authorization and cookie headers (npm#45) so credentials are not forwarded to the new host. The proxy-authorization header is in the same class but was left in place, so it survives onto the redirected request. Drop it alongside authorization and cookie, matching undici, follow-redirects (CVE-2024-28849), and @microsoft/kiota-http-fetchlibrary (CVE-2026-49336).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a request is redirected to a different hostname, minipass-fetch already drops the
authorizationandcookieheaders so credentials are not forwarded to the new host (added in #45). Theproxy-authorizationheader is a credential header in the same class, but it is not dropped, so it stays on the redirected request and reaches the new host.This adds
proxy-authorizationto that same strip, right next toauthorizationandcookie. The redirect condition and everything else are unchanged.The other redirect-following clients already treat
proxy-authorizationas part of this boundary:authorization,cookie, andproxy-authorizationon a cross-origin redirect.Authorization,Proxy-Authorization, andCookieacross host/scheme changes (it addedProxy-Authorizationfor CVE-2024-28849).@microsoft/kiota-http-fetchlibraryaddedProxy-Authorizationto its cross-origin scrub recently (CVE-2026-49336).Scope: this is the same threat model as the existing
authorization/cookiestrip, that is, a caller that sets aProxy-Authorizationheader and then follows a redirect to a different host. It is defence in depth for parity with the clients above, not a new class of exploit.The existing "redirect to different host strips headers" test now also sends a
proxy-authorizationheader and asserts it is absent on the redirected request. Without the change the test fails, because the header reaches the new host.