Описание
fetch: Authorization headers not dropped when redirecting cross-origin
Summary
When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain.
Details
The right behavior would be to drop the Authorization header instead, in this scenario. The same is generally applied to Cookie and Proxy-Authorization headers, and is done for not only host changes, but also protocol/port changes. Generally referred to as "origin".
The documentation states:
Deno does not follow the same-origin policy, because the Deno user agent currently does not have the concept of origins, and it does not have a cookie jar. This means Deno does not need to protect against leaking authenticated data cross origin
Reproduction
Пакеты
deno_fetch
>= 0.0.1, < 0.204.0
0.204.0
deno
<= 1.46.3
Отсутствует
deno
>= 2.0.0, < 2.1.2
2.1.2
Связанные уязвимости
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2.