-
-
Notifications
You must be signed in to change notification settings - Fork 31.7k
bpo-33661: Clear Authorization header when redirect to cross-site #11292
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Hello, and thanks for your contribution! I'm a bot set up to make sure that the project can legally accept your contribution by verifying you have signed the PSF contributor agreement (CLA). Our records indicate we have not received your CLA. For legal reasons we need you to sign this before we can look at your contribution. Please follow the steps outlined in the CPython devguide to rectify this issue. If you have recently signed the CLA, please wait at least one business day You can check yourself to see if the CLA has been received. Thanks again for your contribution, we look forward to reviewing it! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
According to https://bugs.python.org/msg317793. The problem is that both authorization and cookies are sent on the redirect. Here I don't see the filter for Cookies. That is not necessary?
@eamanu Thanks. It slipped my mind. I will add it. BTW, should I add other sensitive headers (WWW-Authenticate, Cookie2), too? |
I will put it in bugs.python for discuss |
Most changes to Python require a NEWS entry. Please add it using the blurb_it web app or the blurb command-line tool. |
This PR is stale because it has been open for 30 days with no activity. |
https://bugs.python.org/issue33661
https://bugs.python.org/issue33661