You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2023/11/16 19:04:36 UTC
(httpcomponents-client) 02/08: HTTPCLIENT-2277: Do not store AUTHORIZATION request header in the cache entry per RFC 9111 section 3.5
This is an automated email from the ASF dual-hosted git repository.
olegk pushed a commit to branch 5.4.x
in repository https://gitbox.apache.org/repos/asf/httpcomponents-client.git
commit e20d0d3bbb4b468a21e4fe7899274c93f439e2c9
Author: Oleg Kalnichevski <ol...@apache.org>
AuthorDate: Mon Oct 23 10:14:39 2023 +0200
HTTPCLIENT-2277: Do not store AUTHORIZATION request header in the cache entry per RFC 9111 section 3.5
---
.../java/org/apache/hc/client5/http/cache/HttpCacheEntryFactory.java | 4 ++++
.../org/apache/hc/client5/http/cache/TestHttpCacheEntryFactory.java | 3 ++-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/httpclient5-cache/src/main/java/org/apache/hc/client5/http/cache/HttpCacheEntryFactory.java b/httpclient5-cache/src/main/java/org/apache/hc/client5/http/cache/HttpCacheEntryFactory.java
index 91c6ae26a..46a8349e6 100644
--- a/httpclient5-cache/src/main/java/org/apache/hc/client5/http/cache/HttpCacheEntryFactory.java
+++ b/httpclient5-cache/src/main/java/org/apache/hc/client5/http/cache/HttpCacheEntryFactory.java
@@ -212,6 +212,8 @@ public class HttpCacheEntryFactory {
final String s = CacheKeyGenerator.getRequestUri(host, request);
final URI uri = CacheKeyGenerator.normalize(s);
final HeaderGroup requestHeaders = filterHopByHopHeaders(request);
+ // Strip AUTHORIZATION from request headers
+ requestHeaders.removeHeaders(HttpHeaders.AUTHORIZATION);
final HeaderGroup responseHeaders = filterHopByHopHeaders(response);
ensureDate(responseHeaders, responseInstant);
return new HttpCacheEntry(
@@ -256,6 +258,8 @@ public class HttpCacheEntryFactory {
final String s = CacheKeyGenerator.getRequestUri(host, request);
final URI uri = CacheKeyGenerator.normalize(s);
final HeaderGroup requestHeaders = filterHopByHopHeaders(request);
+ // Strip AUTHORIZATION from request headers
+ requestHeaders.removeHeaders(HttpHeaders.AUTHORIZATION);
final HeaderGroup mergedHeaders = mergeHeaders(entry, response);
return new HttpCacheEntry(
requestInstant,
diff --git a/httpclient5-cache/src/test/java/org/apache/hc/client5/http/cache/TestHttpCacheEntryFactory.java b/httpclient5-cache/src/test/java/org/apache/hc/client5/http/cache/TestHttpCacheEntryFactory.java
index 96e3fdb0b..7b2bd7ed5 100644
--- a/httpclient5-cache/src/test/java/org/apache/hc/client5/http/cache/TestHttpCacheEntryFactory.java
+++ b/httpclient5-cache/src/test/java/org/apache/hc/client5/http/cache/TestHttpCacheEntryFactory.java
@@ -273,7 +273,8 @@ public class TestHttpCacheEntryFactory {
new BasicHeader("Keep-Alive", "timeout, max=20"),
new BasicHeader("X-custom", "my stuff"),
new BasicHeader(HttpHeaders.ACCEPT, "stuff"),
- new BasicHeader(HttpHeaders.ACCEPT_LANGUAGE, "en, de")
+ new BasicHeader(HttpHeaders.ACCEPT_LANGUAGE, "en, de"),
+ new BasicHeader(HttpHeaders.AUTHORIZATION, "Super secret")
);
response.setHeaders(
new BasicHeader(HttpHeaders.TRANSFER_ENCODING, "identity"),