-
-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Auth on redirect #2328
Auth on redirect #2328
Conversation
Codecov Report
@@ Coverage Diff @@
## master #2328 +/- ##
==========================================
+ Coverage 97.24% 97.24% +<.01%
==========================================
Files 39 39
Lines 8209 8217 +8
Branches 1437 1440 +3
==========================================
+ Hits 7983 7991 +8
Misses 98 98
Partials 128 128
Continue to review full report at Codecov.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
looks good, but you should not rely on my review, someone else should review
Committers, I need a review of the issue. |
Waiting for tomorrow |
if (headers is not None and | ||
auth is not None and | ||
hdrs.AUTHORIZATION in headers): | ||
raise ValueError("Cannot combine AUTHORIZATION header " |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we have tests which triggers these ValueError's? I'm hardly imagine the case for them.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, the PR has a test for the case
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hm...seems it's slipped away from me. Ok.
@@ -322,6 +331,10 @@ def _request(self, method, url, *, | |||
elif not scheme: | |||
r_url = url.join(r_url) | |||
|
|||
if url.origin() != r_url.origin(): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Side note: it seems like relative Location
is legit now.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Relative URL is joined to original two lines above.
r_url
is absolute at this line.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm interpreted it as schemaless url rather then relative one. Fine then.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGFM. These are minor bits, but they can be done in separate work. Support relative redirects would be a new feature in anyway.
@kxepal thank you for careful review. |
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a [new issue] for related bugs. |
Fix for #1699