Core: Authorization and Cookie headers leaked to cross-origin servers on HTTP redirect
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- java
- Domain
- backend-api-design, security
Research direction
Start in HttpRequest.handleRedirect() and execute(), then review the three regression scenarios described in the issue. Verify same-origin behavior across scheme, host, and port changes, including default-port normalization; done when cross-origin Authorization and Cookie headers are absent while same-origin redirects retain expected behavior.
Written by the indexing model from the issue text.
Description
Environment details
- Core - HttpRequest in google-http-client
- OS type and version: Any
- Java version: Any (Java 8+)
- google-http-client version: reproducible on current main
Problem Statement
When HttpRequest follows a redirect to a different origin (different scheme, host, or port),
the Cookie header is not stripped. Additionally, Authorization headers set via interceptors
(e.g. BasicAuthentication) are re-applied by the interceptor on subsequent redirect
iterations regardless of destination origin. This can cause credentials to be silently
forwarded to attacker-controlled servers.
Steps to reproduce
- Build an HttpRequest with an Authorization interceptor (e.g. BasicAuthentication) and a
Cookie header. - Configure the transport to return a 302 redirect to a cross-origin URL (different host).
- Execute the request.
- Observe that the second request (to the cross-origin target) still includes Authorization
and Cookie headers.
Proposed Fix
In handleRedirect(), compute whether the new URL is same-origin as the old URL (comparing
scheme, host, and effective port). Strip Cookie header if cross-origin. In execute(), before
each retry, compare current URL origin to original origin and strip Authorization and Cookie
if the URL has changed to a different origin (e.g. after a previous redirect).
Add getEffectivePort() and isSameOrigin() helpers to normalize default ports (80 for http,
443 for https).
Three regression tests are included in the accompanying PR covering same-origin,
cross-origin host change, scheme change, and port change scenarios.
- Dominant language
- Java
- Stars
- 1.4k
- Forks
- 476
- Avg merge
- 10h 47m
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-http-java-client
-
Core: Validate header names and values to prevent CRLF injectionPossibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Core: XmlPullParser processes external DTD entities (XXE) — disable FEATURE_PROCESS_DOCDECL in Xml#createParser()Possibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Core: LowLevelHttpResponse not disconnected when HttpResponse construction throws RuntimeExceptionPossibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
type: cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
org.apache.http.conn.ssl.SSLSocketFactory is deprecatedMay be free again A pull request for this issue was closed without being merged. Openpriority: p2 type: cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
All issues in googleapis/google-http-java-client
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 Under an hour Newbie friendliness 84/100
cpp-best-practices/project_validator#251 ·
Maintainers usually reply within 1 day
-
backend enhancement
Difficulty 2/5 Half a day Newbie friendliness 70/100
damodharg6/payledger#16 ·
-
[Bug]: An initiative list with no current entry logs an error on every changePossibly taken @dwizard0 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day