Fix credential header leak on cross-domain pscale api redirects#1303
Merged
Conversation
handleRedirect previously copied all original request headers except Authorization when following a cross-domain Location. Users can put secrets in arbitrary --header/-H values (Cookie, X-Api-Key, Proxy-Authorization), which were then forwarded to the redirect target. Follow cross-domain redirects with a fresh request that carries none of the original headers. Co-authored-by: Mike Coutermarsh <coutermarsh.mike@gmail.com>
mscoutermarsh
marked this pull request as ready for review
July 22, 2026 19:49
dgraham
approved these changes
Jul 22, 2026
Resolve conflict with #1301 exact-host redirect checks. Main still copied non-Authorization headers on cross-host redirects; keep the fresh request with no original headers so -H secrets cannot leak. Co-authored-by: Mike Coutermarsh <coutermarsh.mike@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pscale apifollows cross-host redirects inhandleRedirectwith a fresh HTTP client, but previously copied every original request header except the literalAuthorizationheader. Users can supply arbitrary headers via--header/-H(e.g.Cookie,X-Api-Key,Proxy-Authorization), so those secrets were forwarded to whatever host was named inLocation.Fix
Cross-host redirects now use a fresh GET request with no headers copied from the original request. Stripping only
Authorizationis insufficient because credentials can live in any user-supplied header name.Rebased/merged with
mainafter #1301 (exact-host redirect checks). That PR still copied non-Authorizationheaders; this change keeps the no-header-forwarding behavior on top of the tighter host matching.Test plan
go test ./internal/cmd/api/—TestHandleRedirectasserts credential-bearing headers are absent on the redirect request;TestRedirectCheckcovers exact-host matching from Fix OAuth token re-sent to sibling subdomains on redirect #1301pscale apiagainst an endpoint that 302s cross-host with-H 'X-Api-Key: secret'and confirm the secret is not sent to the redirect target