Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/fix_esp_http_client_cross_origin_credentials' into 'master'

Browse Source 
fix(esp_http_client): strip Authorization header on cross-origin redirect

Closes SEC-228 and SEC-049

See merge request espressif/esp-idf!48820
This commit is contained in:
Mahavir Jain
2026-07-06 12:20:51 +05:30
parent 9456ac994e a4b10f1691
commit 442cc028b5
2 changed files with 82 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_http_client/esp_http_client.c
+8
View File
@@ -1268,6 +1268,14 @@ esp_err_t esp_http_client_set_url(esp_http_client_handle_t client, const char *u
free(old_host);
return ESP_ERR_NO_MEM;
}
http_header_delete(client->request->headers, "Authorization");
free(client->connection_info.username);
client->connection_info.username = NULL;
free(client->connection_info.password);
client->connection_info.password = NULL;
free(client->auth_header);
client->auth_header = NULL;
_clear_auth_data(client);
/* Free cached data if any, as we are closing this connection */
esp_http_client_cached_buf_cleanup(client->response->buffer);
esp_http_client_close(client);