Change #274528

Comments

http: scope cached Basic credentials to the origin
* src/http.c: New function basic_auth_key(),
  (maybe_send_basic_creds): Make use of basic_auth_key(),
  (register_basic_auth_host): Likewise,
  (register_basic_auth_host): Change param hostname to struct url,
  (initialize_request): Amend calls to maybe_send_basic_creds() and
  register_basic_auth_host().

Wget records completed Basic challenges in basic_authed_hosts using only the
hostname. A subsequent request to the same hostname on another port
automatically sends Basic credentials, even though the redirect logic
correctly treats a port change as a different origin.

An operator of a separately controlled service on an alternate port can obtain
credentials intended for the first origin when an authenticated flow follows a
URL to that port.

This patch keys the Basic challenge cache by scheme, host, and port, ensuring
credentials are not reused across origin boundaries.

Copyright-paperwork-exempt: Yes

Changed files

• src/http.c