Change #274799

Comments

http: filter Proxy-Authorization on cross-host redirects
* src/http.c (unredirectable_headerline): Filter Proxy-Authorization headers.

A user-provided Proxy-Authorization header is forwarded after a redirect to a
different hostname or port.  A redirect destination can then obtain a value
that was intended for the original site.

Drop this header along with Authorization and Cookie on such redirects.

Copyright-paperwork-exempt: Yes

Changed files

• src/http.c