SoapClient only strips `Authorization: Basic` when a WSDL imports from another host
@DanielEScherzer ya está trabajando en esto.
Desde el 15/9/2026.
Evaluación
Este issue todavía no se ha evaluado.
Descripción
Description
Originally reported by @christos-cantina-security.
When a WSDL imports a schema or another WSDL from a different host, SoapClient clears the credentials from the stream context before fetching it in sdl_set_uri_credentials() @ ext/soap/php_sdl.c. The strip only matches the exact string Authorization: Basic in http.header, and only when that option is a string. The TODO right above it already notes that the array form of http.header is not handled.
Any other credential passes through to the third-party host as-is: a Bearer or Digest Authorization header, a lowercase authorization: header, a Cookie header, a Proxy-Authorization header, and every header given as an array.
The following code, with https://a.example serving a WSDL that contains <xsd:import schemaLocation="https://b.example/schema.xsd"/>:
<?php
$client = new SoapClient('https://a.example/service.wsdl', [
'cache_wsdl' => WSDL_CACHE_NONE,
'stream_context' => stream_context_create([
'http' => ['header' => "Authorization: Bearer secret-token\r\n"],
]),
]);
Resulted in this request on b.example:
GET /schema.xsd HTTP/1.1
Host: b.example
Authorization: Bearer secret-token
But I expected the header to be dropped on the host change, like Authorization: Basic already is:
GET /schema.xsd HTTP/1.1
Host: b.example
This should be hardened on master, potentially introducing a BC break:
- strip every
Authorization,Proxy-AuthorizationandCookieheader, case-insensitively - handle the array form of
http.header, resolving the existingTODO - add a
SoapClientoption to keep the headers for setups where the same credentials serve both hosts - document the behavior change in
UPGRADING
PHP Version
master
Operating System
No response
- Lenguaje dominante
- C
- Estrellas
- 40.4k
- Forks
- 8.2k
- Merge medio
- 2 d 12 h
- PR fusionados (30 d)
- 112
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de php/php-src
-
Bug SAPI: cli_server Status: Verified
Dificultad 2/5 1-3 horas Aptitud para principiantes 88/100
-
Bug Status: Needs Triage
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
-
Bug Status: Needs Triage
Dificultad 1/5 Menos de una hora Aptitud para principiantes 90/100
-
Bug Status: Needs Triage
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
-
Flaky hrtime.phpt test AbiertoBug Category: Tests Status: Verified
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
Todos los issues de php/php-src
Issues similares
-
Dificultad 1/5 Menos de una hora Aptitud para principiantes 92/100
libsdl-org/SDL#16372 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100
corazawaf/coraza-nginx#140 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
BasedHardware/omi#15662 · 1 comentario ·
-
Dificultad 1/5 1-3 horas Aptitud para principiantes 88/100
jamesstringer90/appsandbox#160 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100