supabase / supabase-flutter / 36696205739
92%

DEFAULT BRANCH: main
Ran
Jobs 0
Files 0
Run time –
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
36696205739

push

github

web-flow 
fix(supabase): drop trace headers when a redirect leaves the Supabase hosts (#1895)

## Summary

`TracePropagationClient` decided whether to add `traceparent`,
`tracestate` and `baggage` from the URL a request is sent to, then left
redirects to the inner client. That client copies every header onto the
redirected request: `dart:io` for GET and HEAD redirects and a 303 on a
POST, and clients like `cupertino_http` or `cronet_http` for writes too.
A Supabase host redirecting a traced request to another host therefore
handed that host the trace headers, including `baggage`, which carries
whatever the application puts in it.

When the client has added trace headers to a request, it now turns off
`followRedirects` on it and follows the redirects itself:

- A 303 is followed with a GET without a body (a HEAD stays a HEAD), a
307 or 308 with the same method and body, and a 301 or 302 only for a
GET or HEAD, as `dart:io` does.
- A body is sent again only when the request is a plain `Request`. A
streamed or multipart request answered with a 307 or 308 is returned
unfollowed, since its body cannot be read twice.
- `Location` is resolved against the current URL, and `maxRedirects` and
loop detection surface as a `ClientException`, as `IOClient` reports
them.
- On each hop, the trace headers the client added are removed once the
target is not a Supabase host, and stay removed. Trace headers the
caller set themselves are left alone.
- On a hop to another origin, the headers `dart:io` drops are removed:
`authorization`, `www-authenticate`, `proxy-authorization`,
`proxy-authenticate`, `cookie` and `cookie2`. Following redirects here
is never less safe than leaving them to `dart:io`.
- The final response reports the request the caller sent and the URL it
was redirected to, as `IOClient` does.

Requests without added trace headers and requests that already set
`followRedirects` to `false` are sent unchanged.

Two behavior changes for requests carrying trace headers: wi... (continued)
Source Files on build 36696205739
Detailed source file information is not available for this build.