mirror of
https://github.com/rclone/rclone.git
synced 2026-10-28 14:28:38 -04:00
Nick Craig-Wood
bc1050bc8a
The transport strips the headers set with --header once a redirect chain leaves the originally requested host, but the host comparison ignores the URL scheme. A server which redirects https://host:8443/ to http://host:8443/ keeps the same host and port, so the headers were added to the plaintext request and could be read by anyone on the network path. The redirect chain walk now also treats a hop which downgrades the original HTTPS request to HTTP as leaving the host, so the headers are removed from that hop and every one after it. The transport also logs at debug level when it removes the headers, for either reason, so that a resulting 401 from the redirect target can be diagnosed.