Skip to content

Prevent sending sensitive headers on host change - #2737

Open
stloyd wants to merge 6 commits into
flow-php:1.xfrom
stloyd:bugfix/redirect-sensitive-headers
Open

stloyd wants to merge 6 commits into
flow-php:1.xfrom
stloyd:bugfix/redirect-sensitive-headers

Conversation

@stloyd

@stloyd stloyd commented Nov 12, 2026

Copy link
Copy Markdown
Member

Resolves: #xxx

Change Log


Added

Fixed

Changed

  • Prevent sending sensitive headers on host change

Removed

Deprecated

Security

@codecov

codecov Bot commented Nov 12, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.01%. Comparing base (b11e678) to head (4c71fb0).
⚠️ Report is 2 commits behind head on 1.x.

Additional details and impacted files
@@             Coverage Diff              @@
##                1.x    #2737      +/-   ##
============================================
  Coverage     91.01%   91.01%              
- Complexity        0    32035   +32035     
============================================
  Files          2237     2238       +1     
  Lines         92557    92566       +9     
============================================
+ Hits          84239    84248       +9     
  Misses         8318     8318              
Components Coverage Δ
etl 96.20% <ø> (ø)
cli 87.40% <ø> (ø)
lib-array-dot 96.52% <ø> (ø)
lib-azure-sdk 64.17% <ø> (ø)
lib-doctrine-dbal-bulk 94.25% <ø> (ø)
lib-filesystem 89.17% <ø> (ø)
lib-types 94.64% <ø> (ø)
lib-parquet 82.80% <ø> (ø)
lib-parquet-viewer 83.15% <ø> (ø)
lib-snappy 89.86% <ø> (ø)
lib-dremel 0.00% <ø> (ø)
lib-postgresql 90.42% <ø> (ø)
lib-telemetry 86.85% <ø> (ø)
bridge-filesystem-async-aws 96.12% <ø> (ø)
bridge-filesystem-azure 94.39% <ø> (ø)
bridge-filesystem-sftp 90.29% <ø> (ø)
bridge-monolog-http 96.84% <ø> (ø)
bridge-monolog-telemetry 92.85% <ø> (ø)
bridge-openapi-specification 91.95% <ø> (ø)
symfony-http-foundation 80.76% <ø> (ø)
bridge-symfony-console 98.01% <ø> (ø)
bridge-psr18-telemetry 100.00% <ø> (ø)
bridge-psr3-telemetry 98.95% <ø> (ø)
bridge-psr7-telemetry 100.00% <ø> (ø)
bridge-telemetry-otlp 90.11% <ø> (ø)
bridge-symfony-http-foundation-telemetry 92.85% <ø> (ø)
bridge-symfony-filesystem-bundle 93.00% <ø> (ø)
bridge-symfony-filesystem-cache 98.18% <ø> (ø)
bridge-symfony-postgresql-bundle 93.35% <ø> (ø)
bridge-symfony-postgresql-cache 94.41% <ø> (ø)
bridge-symfony-postgresql-messenger 98.80% <ø> (ø)
bridge-symfony-postgresql-session 93.65% <ø> (ø)
bridge-symfony-telemetry-bundle 90.76% <ø> (ø)
adapter-chartjs 82.46% <ø> (ø)
adapter-csv 97.68% <ø> (ø)
adapter-doctrine 95.14% <ø> (ø)
adapter-google-sheet 97.53% <ø> (ø)
adapter-http 87.40% <100.00%> (+0.21%) ⬆️
adapter-json 90.62% <ø> (ø)
adapter-logger 47.05% <ø> (ø)
adapter-parquet 97.20% <ø> (ø)
adapter-text 97.68% <ø> (ø)
adapter-xml 98.01% <ø> (ø)
adapter-avro 6.25% <ø> (ø)
adapter-excel 96.79% <ø> (ø)
adapter-postgresql 97.35% <ø> (ø)
adapter-seal 90.00% <ø> (ø)
bridge-phpunit-postgresql 75.30% <ø> (ø)
bridge-phpunit-telemetry 87.36% <ø> (ø)
bridge-phpstan-types 0.00% <ø> (ø)
bridge-postgresql-valinor 100.00% <ø> (ø)
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.


if (
$oldUri->getHost() !== $newUri->getHost()
|| $oldUri->getScheme() === 'https' && $newUri->getScheme() === 'http'

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO this should be:

Suggested change
|| $oldUri->getScheme() === 'https' && $newUri->getScheme() === 'http'
|| ($oldUri->getScheme() === 'https' && $newUri->getScheme() === 'http')

But Mago forces removal of parentheses, and the code's behavior can be different.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm I wonder if we cuold maybe turn off that mago rule 🤔

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reported to Mago: carthage-software/mago#2696

*/
public static function toArray(): array
{
return array_column(self::cases(), 'value');

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reported as it's false-positive IMO: carthage-software/mago#2695

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yea, but it can be written like that, I just think mago can't really follow the array_column magic here. Code below it can understands

return array_map(static fn (self $header): string => $header->value, self::cases());

{
case Authorization = 'Authorization';
case ProxyAuthorization = 'Proxy-Authorization';
case Cookie = 'Cookie';

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's still missing a lot of headers that are sensitive by default

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants