Nick Craig-Wood b4659519df fshttp: refuse HTTPS to HTTP redirects unless --allow-https-downgrade GHSA-m97j-7x65-wh93 CVE-PENDING ...

A server which redirects an https:// request to an http:// URL makes
rclone replay the request in cleartext. Any credentials the backend
sets as headers are then readable by anyone on the network path, and
the response can be altered in transit.

The transport now refuses to follow such a redirect, so this holds for
every client built on it, including those of libraries which install
their own redirect policy. Use --allow-https-downgrade to follow the
redirect anyway, for example when downloading from a mirror which
redirects to plain HTTP.

Backends which check redirects themselves still refuse a downgrade
which would send their credentials in cleartext, regardless of the
flag.

2026-11-06 12:08:09 +00:00

..

test

http: add basic metadata and provide it via serve

2025-11-17 16:52:30 +00:00

http_internal_test.go

fshttp: refuse HTTPS to HTTP redirects unless --allow-https-downgrade GHSA-m97j-7x65-wh93 CVE-PENDING

2026-11-06 12:08:09 +00:00

http.go

fshttp: refuse HTTPS to HTTP redirects unless --allow-https-downgrade GHSA-m97j-7x65-wh93 CVE-PENDING

2026-11-06 12:08:09 +00:00