TigahandGitHub 03b023eba5 fix(httpx): stop leaking cookie/auth headers on cross-host redirects (#332) ...

roundTripper.RoundTrip injects the global cookie, custom headers and
user agent on every hop, including redirect requests. because that
injection sits below the client's redirect handling, it undoes
net/http's own stripping of Cookie/Authorization/Www-Authenticate
when a redirect crosses hosts, so a target that 302s to an attacker
host would receive the scan's secret cookie and bearer token.

req.Response is only set on requests net/http built to follow a
redirect, and its Request field is the prior hop, so comparing hosts
there is enough to detect a cross-host hop without any extra state.
skip the sensitive header classes on that hop and keep injecting
everything else as before.

2026-07-22 12:53:32 -07:00

..

httpx_test.go

fix(httpx): stop leaking cookie/auth headers on cross-host redirects (#332)

2026-07-22 12:53:32 -07:00

httpx.go

fix(httpx): stop leaking cookie/auth headers on cross-host redirects (#332)

2026-07-22 12:53:32 -07:00