Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-05-28 16:46:31 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/https-redirect-downgrade' into 'master'

Browse Source 
fix(esp_http_client): block HTTPS-to-HTTP redirect downgrade

See merge request espressif/esp-idf!47553
This commit is contained in:
Mahavir Jain
2026-05-27 17:30:36 +05:30
parent fb65f973f1 cec6f5bff4
commit 1fc4f6653a
3 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/esp_common/src/esp_err_to_name.c
View File

@@ -682,6 +682,10 @@ static const esp_err_msg_t esp_err_msg_table[] = {
# ifdef ESP_ERR_HTTP_INCOMPLETE_DATA
ERR_TBL_IT(ESP_ERR_HTTP_INCOMPLETE_DATA), /* 28684 0x700c Incomplete data received, less than
Content-Length or last chunk */
# endif
# ifdef ESP_ERR_HTTP_REDIRECT_DOWNGRADE
ERR_TBL_IT(ESP_ERR_HTTP_REDIRECT_DOWNGRADE), /* 28685 0x700d HTTPS origin redirected to a non-HTTPS
scheme (downgrade blocked) */
# endif
// components/esp-tls/esp_tls_errors.h
# ifdef ESP_ERR_ESP_TLS_BASE

20
components/esp_http_client/esp_http_client.c
View File

@@ -1151,6 +1151,19 @@ esp_err_t esp_http_client_set_redirection(esp_http_client_handle_t client)
return ESP_ERR_INVALID_ARG;
}
ESP_LOGD(TAG, "Redirect to %s", client->location);
/* On an HTTPS origin, only allow https:// redirect targets. Any other
* scheme (http, ftp, ws, ...) is rejected before client state is
* modified to prevent transport-layer downgrade attacks. */
if (client->connection_info.scheme != NULL &&
strcasecmp(client->connection_info.scheme, "https") == 0 &&
strncasecmp(client->location, "https://", 8) != 0) {
ESP_LOGE(TAG, "HTTPS origin can only redirect to https:// targets (got %s). "
"Set disable_auto_redirect and handle manually if intended.",
client->location);
return ESP_ERR_HTTP_REDIRECT_DOWNGRADE;
}
esp_err_t err = esp_http_client_set_url(client, client->location);
if (err == ESP_OK) {
client->redirect_counter ++;
@@ -1187,9 +1200,10 @@ static esp_err_t esp_http_check_response(esp_http_client_handle_t client)
if (client->disable_auto_redirect) {
http_dispatch_event(client, HTTP_EVENT_REDIRECT, NULL, 0);
} else {
if (esp_http_client_set_redirection(client) != ESP_OK){
return ESP_FAIL;
};
esp_err_t redir_err = esp_http_client_set_redirection(client);
if (redir_err != ESP_OK) {
return redir_err;
}
}
esp_http_client_redirect_event_data_t evt_data = {
.status_code = client->response->status_code,

1
components/esp_http_client/include/esp_http_client.h
View File

@@ -297,6 +297,7 @@ typedef enum {
#define ESP_ERR_HTTP_RANGE_NOT_SATISFIABLE (ESP_ERR_HTTP_BASE + 10) /*!< HTTP 416 Range Not Satisfiable, requested range in header is incorrect */
#define ESP_ERR_HTTP_READ_TIMEOUT (ESP_ERR_HTTP_BASE + 11) /*!< HTTP data read timeout */
#define ESP_ERR_HTTP_INCOMPLETE_DATA (ESP_ERR_HTTP_BASE + 12) /*!< Incomplete data received, less than Content-Length or last chunk */
#define ESP_ERR_HTTP_REDIRECT_DOWNGRADE (ESP_ERR_HTTP_BASE + 13) /*!< HTTPS origin redirected to a non-HTTPS scheme (downgrade blocked) */
/**
* @brief Start a HTTP session