Skip to content
Go CI

fix/security: strip auth headers on cross-host redirect #7271

Sign in to view logs

fix/security: strip auth headers on cross-host redirect

fix/security: strip auth headers on cross-host redirect #7271

Triggered via push August 13, 2026 16:07
@cbrnrdcbrnrd
pushed 7bb91b5
carterbrainerd-vuln-114-cross-host-redirect-causes-oauth-bearer-token-exfiltration
Status Success
Total duration 8m 43s
Artifacts –

go-ci.yml

on: push
Matrix: go-test
go-test-complete
4s
go-test-complete
Fit to window
Zoom out
Zoom in

Annotations

3 warnings
go-test (ubuntu-latest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-go@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
go-test (macos-latest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-go@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
go-test (windows-latest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-go@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/