Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/fix_esp_http_client_cross_origin_credentials' into 'master'

Browse Source 
fix(esp_http_client): strip Authorization header on cross-origin redirect

Closes SEC-228 and SEC-049

See merge request espressif/esp-idf!48820
This commit is contained in:
Mahavir Jain
2026-07-06 12:20:51 +05:30
parent 9456ac994e a4b10f1691
commit 442cc028b5
2 changed files with 82 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_http_client/esp_http_client.c
+8
View File
@@ -1268,6 +1268,14 @@ esp_err_t esp_http_client_set_url(esp_http_client_handle_t client, const char *u
free(old_host);
return ESP_ERR_NO_MEM;
}
http_header_delete(client->request->headers, "Authorization");
free(client->connection_info.username);
client->connection_info.username = NULL;
free(client->connection_info.password);
client->connection_info.password = NULL;
free(client->auth_header);
client->auth_header = NULL;
_clear_auth_data(client);
/* Free cached data if any, as we are closing this connection */
esp_http_client_cached_buf_cleanup(client->response->buffer);
esp_http_client_close(client);
components/esp_http_client/test_apps/main/test_http_client.c
+74
View File
@@ -188,6 +188,80 @@ TEST_CASE("esp_http_client_set_header() should not return error if header value
esp_http_client_cleanup(client);
}
TEST_CASE("set_url() to a different host strips Authorization header", "[esp_http_client]")
{
esp_http_client_config_t config = {
.url = "http://httpbin.org/get",
};
esp_http_client_handle_t client = esp_http_client_init(&config);
TEST_ASSERT_NOT_NULL(client);
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_header(client, "Authorization", "Bearer secret-token"));
char *value = NULL;
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_header(client, "Authorization", &value));
TEST_ASSERT_NOT_NULL(value);
/* Simulate a redirect target */
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_url(client, "http://attacker.example/steal"));
value = NULL;
esp_err_t err = esp_http_client_get_header(client, "Authorization", &value);
TEST_ASSERT_EQUAL(ESP_ERR_NOT_FOUND, err);
TEST_ASSERT_NULL(value);
esp_http_client_cleanup(client);
}
TEST_CASE("set_url() to the same host preserves Authorization header", "[esp_http_client]")
{
esp_http_client_config_t config = {
.url = "http://httpbin.org/get",
};
esp_http_client_handle_t client = esp_http_client_init(&config);
TEST_ASSERT_NOT_NULL(client);
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_header(client, "Authorization", "Bearer token"));
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_url(client, "http://httpbin.org/other"));
char *value = NULL;
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_header(client, "Authorization", &value));
TEST_ASSERT_NOT_NULL(value);
TEST_ASSERT_EQUAL_STRING("Bearer token", value);
esp_http_client_cleanup(client);
}
TEST_CASE("set_url() to a different host clears URL-embedded credentials", "[esp_http_client]")
{
esp_http_client_config_t config = {
.host = HOST,
.path = "/",
.username = USERNAME,
.password = PASSWORD,
};
esp_http_client_handle_t client = esp_http_client_init(&config);
TEST_ASSERT_NOT_NULL(client);
char *value = NULL;
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_username(client, &value));
TEST_ASSERT_NOT_NULL(value);
value = NULL;
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_password(client, &value));
TEST_ASSERT_NOT_NULL(value);
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_url(client, "http://attacker.example/steal"));
value = NULL;
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_username(client, &value));
TEST_ASSERT_NULL(value);
value = NULL;
TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_password(client, &value));
TEST_ASSERT_NULL(value);
esp_http_client_cleanup(client);
}
static int disconnect_event_count = 0;
static esp_err_t disconnect_event_handler(esp_http_client_event_t *evt)