go-pkgz / requester
93%
main: 88%

LAST BUILD BRANCH: refs/tags/v0.5.0
DEFAULT BRANCH: main
Repo Added
Files 11
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH refs/tags/v0.5.0
branch: SELECT
CHANGE BRANCH
x

coverage: 92.687% (+0.3%) from 92.348%
32228803960

push

github

web-flow 
fix: keep credentials on the host the request started from (#13)

* fix: keep credentials on the host the request started from

Header and BasicAuth restored credentials on every hop, including the ones
the client stripped when a redirect left the original host, so a 302 to
another host received them.

Credentials are now set while the chain stays on the original host or one
of its subdomains, matching how the standard client decides it, and
SecretHeader gives the same protection to a custom header carrying a
secret.

* fix: leave credential headers of the destination alone

Off the original host the client copies no credential header from the
original request, so what the middleware sees there belongs to the
destination, set by a CheckRedirect hook or by the cookie jar. Recognised
keys are now left untouched instead of being matched by value, which erased
a destination value equal to the configured one.

A header the client doesn't recognise as a credential is still removed
whole, since that one does get copied to every hop.

The middleware fills the request in on the response when the transport
below leaves it unset, so a redirect through such a transport keeps its
credentials on the original host.

* chore: update example dependencies

lcw to v1.2.0, which drops hashicorp/errwrap and go-multierror and brings
go-redis v9.18.0 and go.uber.org/atomic.

The go directive stays at 1.23, so go-redis stops at v9.18.0: v9.19.0 needs
go 1.24 and the current x/sys needs 1.25.

* ci: limit the workflow token to reading the repository

The job checks out, builds, lints and posts coverage to coveralls, none of
which writes to the repository, so the token gets contents: read as the
rest of the org does it.

60 of 62 new or added lines in 1 file covered. (96.77%)

583 of 629 relevant lines covered (92.69%)

20.03 hits per line

Relevant lines Covered
629 RELEVANT LINES 583 COVERED LINES
20.03 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
32228803960 refs/tags/v0.5.0 fix: keep credentials on the host the request started from (#13) * fix: keep credentials on the host the request started from Header and BasicAuth restored credentials on every hop, including the ones the client stripped when a redirect left the... push web-flow github
92.69
32227807448 master fix: keep credentials on the host the request started from (#13) * fix: keep credentials on the host the request started from Header and BasicAuth restored credentials on every hop, including the ones the client stripped when a redirect left the... push web-flow github
92.69
32225751349 fix/redirect-credential-leak ci: limit the workflow token to reading the repository The job checks out, builds, lints and posts coverage to coveralls, none of which writes to the repository, so the token gets contents: read as the rest of the org does it. Pull #13 paskal github
92.69
32225408215 fix/redirect-credential-leak chore: update example dependencies lcw to v1.2.0, which drops hashicorp/errwrap and go-multierror and brings go-redis v9.18.0 and go.uber.org/atomic. The go directive stays at 1.23, so go-redis stops at v9.18.0: v9.19.0 needs go 1.24 and the cur... Pull #13 paskal github
92.69
32224768447 chore/example-deps chore: update example dependencies lcw to v1.2.0, which drops hashicorp/errwrap and go-multierror and brings go-redis v9.18.0 and go.uber.org/atomic. The go directive stays at 1.23, so go-redis stops at v9.18.0: v9.19.0 needs go 1.24 and the cur... Pull #14 paskal github
92.35
32221645699 fix/redirect-credential-leak fix: keep credentials on the host the request started from Header and BasicAuth restored credentials on every hop, including the ones the client stripped when a redirect left the original host, so a 302 to another host received them. Credentials... Pull #13 paskal github
92.77
32208381436 refs/tags/v0.4.1 chore: update dependencies (#12) testify to v1.12.0, which no longer needs go-spew and go-difflib, so the module graph loses two entries. _example gets patch-level updates only, go-redis v9.17.3 and a tidy that drops the stale go-redis v7 and pk... push web-flow github
92.35
32206000540 master chore: update dependencies (#12) testify to v1.12.0, which no longer needs go-spew and go-difflib, so the module graph loses two entries. _example gets patch-level updates only, go-redis v9.17.3 and a tidy that drops the stale go-redis v7 and pk... push web-flow github
92.35
32205993144 master chore: apply go fix (#11) interface{} to any across the package, loops over a count to range over int, membership loops to slices.Contains and a Sprintf-to-byte-slice to fmt.Appendf. All of it is available in go 1.23, the directive stays. push web-flow github
92.35
32205985563 master ci: update actions and linter to the current versions (#10) checkout v4 to v7, setup-go v5 to v6, golangci-lint-action v7 to v9 with golangci-lint v2.12.2. go-version stays at 1.23, matching go.mod. Empty branches and tags keys under the push tr... push web-flow github
92.36
See All Builds (67)