Revanth14 commented on code in PR #2098:
URL: https://github.com/apache/iceberg-go/pull/2098#discussion_r4211004683
##########
catalog/rest/rest.go:
##########
@@ -305,7 +326,12 @@ func (s *sessionTransport) RoundTrip(r *http.Request)
(*http.Response, error) {
r.Header.Set(k, v)
}
- if s.signer != nil && (s.signingOrigin == nil ||
sameOrigin(s.signingOrigin, r.URL)) {
+ // A signer only signs requests to the configured catalog origin: a
request
+ // to a different origin (e.g. a redirect hop) is left unsigned, so the
+ // signer's Authorization header and any session token never reach an
+ // unconfigured host. The guard lives here, in core, so it covers every
+ // signer, including one installed verbatim via WithSigner.
+ if s.signer != nil && toCatalog {
Review Comment:
Documented on `WithSigner`: a signer only runs for requests to the catalog
origin, so a token endpoint set with `WithAuthURI` gets unsigned requests. This
isn't new in this PR: the old `signingOrigin` was always equal to
`catalogOrigin` and behaved the same way.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
