Skip to content

Commit

Permalink
Remove the host header on redirect (#1241)
Browse files Browse the repository at this point in the history
  • Loading branch information
mittwillson authored May 10, 2020
1 parent ab338a7 commit 8ff71d9
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 1 deletion.
4 changes: 4 additions & 0 deletions source/core/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -1057,6 +1057,10 @@ export default class Request extends Duplex implements RequestEvents<Request> {

// Redirecting to a different site, clear sensitive data.
if (redirectUrl.hostname !== url.hostname) {
if ('host' in options.headers) {
delete options.headers.host;
}

if ('cookie' in options.headers) {
delete options.headers.cookie;
}
Expand Down
12 changes: 11 additions & 1 deletion test/redirects.ts
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import {TLSSocket} from 'tls';
import test from 'ava';
import {Handler} from 'express';
import nock = require('nock');
import {MaxRedirectsError} from '../source';
import got, {MaxRedirectsError} from '../source';
import withServer from './helpers/with-server';

const reachedHandler: Handler = (_request, response) => {
Expand Down Expand Up @@ -432,3 +432,13 @@ test('clears the authorization header when redirecting to a different hostname',
}).json();
t.is(headers.Authorization, undefined);
});

test('clears the host header when redirecting to a different hostname', async t => {
nock('https://testweb.com').get('/redirect').reply(302, undefined, {location: 'https://webtest.com/'});
nock('https://webtest.com').get('/').reply(function (_uri, _body) {
return [200, this.req.getHeader('host')];
});

const resp = await got('https://testweb.com/redirect', {headers: {host: 'wrongsite.com'}});
t.is(resp.body, 'webtest.com');
});

0 comments on commit 8ff71d9

Please sign in to comment.