Change #272908

Comments

http: trim custom header name before the Authorization drop
A custom header name padded with blanks (`Authorization :`) missed the
exact-length compare and slipped past the cross-host Authorization and
Cookie drop, forwarding the header to the redirect target. Trim the
parsed name in both the request and proxy CONNECT header builders.

Closes #22178

Changed files

• lib/http.c
• lib/http_proxy.c
• tests/data/Makefile.am
• tests/data/test2113