-
-
Notifications
You must be signed in to change notification settings - Fork 62
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bug in auto_referer implementation #392
Comments
Good catch, thanks for letting me know about this! This is indeed the wrong behavior. |
sagebind
added a commit
that referenced
this issue
May 5, 2022
URL fragments and userinfo parts of the authority should not be included in the Referer header when `auto_referer` is enabled. Fixes #392
sagebind
added a commit
that referenced
this issue
May 5, 2022
URL fragments and userinfo parts of the authority should not be included in the Referer header when `auto_referer` is enabled. Fixes #392
sagebind
added a commit
that referenced
this issue
May 6, 2022
Fix various aspects of the `auto_referer` option: - Fix multiple `Referer` headers being included when two or more redirects are followed in a request - URL fragments and userinfo parts of the authority should not be included in the `Referer` header - Don't include a `Referer` header when redirecting from an HTTPS URL to an HTTP URL, as per [RFC 7231](https://httpwg.org/specs/rfc7231.html#header.referer) recommendation - Scrub sensitive headers when redirecting to a different authority Fixes #392
sagebind
added a commit
that referenced
this issue
May 13, 2022
Fix various aspects of the `auto_referer` option: - Fix multiple `Referer` headers being included when two or more redirects are followed in a request - URL fragments and userinfo parts of the authority should not be included in the `Referer` header - Don't include a `Referer` header when redirecting from an HTTPS URL to an HTTP URL, as per [RFC 7231](https://httpwg.org/specs/rfc7231.html#header.referer) recommendation - Scrub sensitive headers when redirecting to a different authority Fixes #392
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When
isahc
is asked to follow redirects with auto_referer enabled, it will add aReferer
header to subsequent requests after being redirected. However, the current implementation does not remove previousReferer
headers. Therefore, the final request will have multipleReferer
headers if it is redirected more than once. This is different fromcurl --location --referer ";auto"
which only retains the lastReferer
header. I think this is a bug and should be fixed.isahc/src/redirect.rs
Lines 83 to 87 in 2a5c175
By the way, the current implementation also does not remove the fragment and userinfo components of the URI, a
MUST NOT
requirement in RFC 7231.curl
conforms to the RFC, and it would be nice ifisach
does as well.The text was updated successfully, but these errors were encountered: