Skip to content

Feature: fix a number of redirect handling issues#271

Closed
rexxars wants to merge 1 commit intomainfrom
fix/redirect-handling
Closed

Feature: fix a number of redirect handling issues#271
rexxars wants to merge 1 commit intomainfrom
fix/redirect-handling

Conversation

@rexxars
Copy link
Copy Markdown
Member

@rexxars rexxars commented May 10, 2022

When requesting an eventsource endpoint and defining custom, sensitive headers, such as Authorization and Cookie, these headers should not be forwarded when redirecting to a different origin than the original.

While looking in to fixing this, I discovered that the current redirect handling also does not support relative URLs in the Location header (eg Location: /some/other/path), nor does it set any limit on the maximum number of redirects. Instead of attempting to patch all these shortcomings, I feel we are better suited by utilizing the follow-redirects module, which handles all of these cases and is widely used.

Copy link
Copy Markdown
Contributor

@joeybaker joeybaker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing. Moderately unfortunate that we're back to having dependencies, but seems fine.

We should however release this as a major update since webpack configs may need to be updated.

Comment thread lib/eventsource.js Outdated
if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 307) {
if (!res.headers.location) {
// Server sent redirect response without Location header.
_emit('error', new Event('error', {status: res.statusCode, message: res.statusMessage}))
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this isn't important, but we are loosing this error reporting. Probably fine?

@rexxars rexxars changed the title Fix: strip sensitive headers on redirect to different origin Feature: fix a number of redirect handling issues May 11, 2022
@rexxars
Copy link
Copy Markdown
Member Author

rexxars commented May 11, 2022

We should however release this as a major update since webpack configs may need to be updated.

I don't think there should be any config changes necessary, but given I am not 100% sure, I agree with your point. Given this is patching a security issue, I really want to get a patch release out to ensure people don't have to upgrade to a new major to be covered. I have opened #273 to address only the headers issue, leaving this one as a general redirect handling PR.

Would you mind reviewing that one, @joeybaker ?

@gogodigimo
Copy link
Copy Markdown

Looks like this perhaps got left out in the cold. Any idea if this PR will get merged in?

@rexxars rexxars force-pushed the main branch 2 times, most recently from 6349107 to 0338f51 Compare December 7, 2024 18:49
@rexxars
Copy link
Copy Markdown
Member Author

rexxars commented Dec 7, 2024

eventsource@^3 has a completely new implementation based on fetch() which should automatically take care of redirects.

@rexxars rexxars closed this Dec 7, 2024
@rexxars rexxars deleted the fix/redirect-handling branch December 7, 2024 22:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants