go-pkgz / requester / 32227807448

93%

main: 88%

push

github

fix: keep credentials on the host the request started from (#13)

* fix: keep credentials on the host the request started from

Header and BasicAuth restored credentials on every hop, including the ones
the client stripped when a redirect left the original host, so a 302 to
another host received them.

Credentials are now set while the chain stays on the original host or one
of its subdomains, matching how the standard client decides it, and
SecretHeader gives the same protection to a custom header carrying a
secret.

* fix: leave credential headers of the destination alone

Off the original host the client copies no credential header from the
original request, so what the middleware sees there belongs to the
destination, set by a CheckRedirect hook or by the cookie jar. Recognised
keys are now left untouched instead of being matched by value, which erased
a destination value equal to the configured one.

A header the client doesn't recognise as a credential is still removed
whole, since that one does get copied to every hop.

The middleware fills the request in on the response when the transport
below leaves it unset, so a redirect through such a transport keeps its
credentials on the original host.

* chore: update example dependencies

lcw to v1.2.0, which drops hashicorp/errwrap and go-multierror and brings
go-redis v9.18.0 and go.uber.org/atomic.

The go directive stays at 1.23, so go-redis stops at v9.18.0: v9.19.0 needs
go 1.24 and the current x/sys needs 1.25.

* ci: limit the workflow token to reading the repository

The job checks out, builds, lints and posts coverage to coveralls, none of
which writes to the repository, so the token gets contents: read as the
rest of the org does it.

60 of 62 new or added lines in 1 file covered. (96.77%)

583 of 629 relevant lines covered (92.69%)

20.03 hits per line