Should Authorization header be cleared in https -> http redirect?

[bmerry]

This may be considered intentional behaviour (in which case feel free to close this), but if a request is made to an https endpoint with authorization and it redirects to http on the same host, the Authorization header is not stripped and will be exposed on the wire.

Expected Result

rebuild_auth would strip the Authorization header if the scheme is changed from https to http.

Actual Result

The credentials that were intended to be sent over TLS were transmitted in plaintext with the redirected request.

Reproduction Steps

Run an HTTPS server on localhost:4443 that replies with a 302 redirect to http://localhost:8000, and a plain HTTP server (or netcat) on localhost:8000. Then run

import requests
requests.get('https://localhost:4443', auth=('hello', 'world'), verify=False)

The basic auth credentials are sent in plaintext to http://localhost:8000 (the verify=False is just because I had a self-signed cert).

Here's the code I used for the SSL server:

import BaseHTTPServer
import ssl

class Handler(BaseHTTPServer.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        self.send_header('Location', 'http://localhost:8000/')
        self.end_headers()
        self.wfile.write('')

httpd = BaseHTTPServer.HTTPServer(('localhost', 4443), Handler)
httpd.socket = ssl.wrap_socket (httpd.socket, server_side=True,
                                certfile='yourpemfile.pem')
httpd.serve_forever()

System Information

{
  "chardet": {
    "version": "3.0.4"
  }, 
  "cryptography": {
    "version": "2.2.2"
  }, 
  "idna": {
    "version": "2.7"
  }, 
  "implementation": {
    "name": "CPython", 
    "version": "2.7.12"
  }, 
  "platform": {
    "release": "4.15.0-23-generic", 
    "system": "Linux"
  }, 
  "pyOpenSSL": {
    "openssl_version": "1010008f", 
    "version": "18.0.0"
  }, 
  "requests": {
    "version": "2.19.1"
  }, 
  "system_ssl": {
    "version": "1000207f"
  }, 
  "urllib3": {
    "version": "1.23"
  }, 
  "using_pyopenssl": true
}

[bmerry]

From what I can tell by experiment, Firefox and Chromium treat http and https versions of a site as separate authentication realms, and don't automatically reuse basic credentials on either a redirect or manual browsing between the two. Two http URLs with the same host (localhost) and different port numbers also seem to be treated as independent realms.

[bmerry]

Found something about it in RFC 7235, section 2.2.

A protection space is defined by the canonical root URI (the scheme and authority components of the effective request URI; see Section 5.5 of [RFC7230]) of the server being accessed, in combination with the realm value if present.

which suggests that both the scheme and port number should be considered (and in theory one should also check the realm, but that doesn't really fit into request's model that basic credentials are supplied unconditionally rather than in response to WWW-Authentication).

[thinkt4nk]

is this going to get a release?

[nateprewitt]

Yes @thinkt4nk, we’re currently coordinating a release with the urllib3 team.