slachiewicz opened a new issue, #956: URL: https://github.com/apache/maven-wagon/issues/956
`wagon-http` applies the headers configured for a repository (`setHttpHeaders`, used by Maven for `<server><configuration><httpHeaders>`, and the `<httpConfiguration>` method headers) to every request it sends, and Apache HttpClient copies the headers of the original request onto each redirected request. When a repository answers with a redirect to a different host, port or scheme, those headers are therefore sent to the redirect target as well. Headers configured this way are frequently credentials: a static `Authorization: Bearer …` or a private-repository token header. A repository that redirects downloads to a CDN or mirror, or that is itself compromised, ends up receiving them at a host the operator never configured them for. Basic authentication handled through the credentials provider is not affected, because HttpClient scopes it by host; only the configured header set is. `AbstractHttpClientWagon.setHeaders` sets the headers on the request, `WagonRedirectStrategy` builds the redirected request and HttpClient's `RedirectExec` copies the headers over; nothing removes them. Both `master` and `wagon-3.x` have the same code. `wagon-http-lightweight` has the equivalent behaviour through `HttpURLConnection`. Expected: headers configured for a repository are sent only to that repository's origin (same scheme, host and effective port); a redirect within the origin keeps them, a redirect to another origin does not. The native resolver transports were changed to behave this way in apache/maven-resolver#2085, so `wagon-http` should match. *This issue was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
