gnodet commented on PR #2085: URL: https://github.com/apache/maven-resolver/pull/2085#issuecomment-5476262533
@cstamas — good question. The URL transport (`UrlTransporter`) **already has both guards** built in: 1. **TLS downgrade rejection** (line 358–363): blocks HTTPS → HTTP redirects unless `redirectAllowDowngrade` is explicitly enabled (`false` by default) 2. **Credential scoping on redirect** (line 349–356): strips auth when the redirect target has a different authority These were already part of the URL transport's redirect handling prior to this PR. The three transports that needed fixing were: - **Apache** (f008): silently followed https→http downgrades - **JDK** (f009): `Authenticator` handed credentials to any challenging host - **Jetty** (f016): followed https→http redirects without a downgrade guard The URL transport was already doing the right thing here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
