Samin061 opened a new pull request, #70000:
URL: https://github.com/apache/airflow/pull/70000
An HTTP connection's `extra` field is documented as a place to put
credentials ("Login and Password authentication can be used along with any
authentication method using headers"), and those end up in `session.headers`,
while `run_and_check` follows redirects by default. `requests` strips only
`Authorization` once `should_strip_auth` sees the host change, so a secret
under any other name (`X-API-Key`, `Private-Token`) is replayed to the redirect
target — whether that is an attacker's host reached through an open redirect on
the API, or simply the CDN the API bounces downloads to. This gives the
connection's own headers the same treatment as `Authorization`; same-host
redirects still carry them.
`HttpAsyncHook` has the same gap and `aiohttp` behaves identically, but it
offers no equivalent redirect hook, so covering it means reworking the async
redirect handling rather than extending an existing one. I left it out to keep
this reviewable, and I'm happy to follow up if you'd like it in scope.
The `FakeSession` patch targets in the sensor tests move to the new class
because the hook now instantiates it.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (Opus 4.8) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
