gnodet-bot commented on code in PR #2211:
URL: https://github.com/apache/maven-resolver/pull/2211#discussion_r4323702301
##########
maven-resolver-transport-url/src/main/java/org/eclipse/aether/transport/url/UrlTransporterConfigurationKeys.java:
##########
@@ -41,7 +41,9 @@ private UrlTransporterConfigurationKeys() {}
* @configurationType {@link String}
* @configurationDefaultValue {@link #DEFAULT_REDIRECT_MODE}
* @configurationRepoIdSuffix Yes
+ * @deprecated Use {@link
ConfigurationProperties#HTTP_FOLLOW_INSECURE_REDIRECT} and {@link
ConfigurationProperties#HTTP_ORIGIN_SCOPED_HEADERS} instead.
Review Comment:
`CONFIG_PROP_REDIRECT_MODE` supports three modes: `ANY`, `SAME_AUTHORITY`,
and `NONE`. The suggested replacements (`HTTP_FOLLOW_INSECURE_REDIRECT` and
`HTTP_ORIGIN_SCOPED_HEADERS`) cover protocol-downgrade protection and
credential scoping on redirects, but provide **no equivalent for
`SAME_AUTHORITY`** — which blocks all redirects to a different authority
regardless of scheme.
Users who set `redirectMode=SAME_AUTHORITY` to prevent any cross-server
redirect (not just insecure ones) have no migration path through the suggested
replacements. The `@deprecated` Javadoc should clarify this: either note that
`SAME_AUTHORITY` has no direct replacement, or introduce a shared equivalent
before deprecating `CONFIG_PROP_REDIRECT_MODE`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
