gh-155694: Scope HTTPPasswordMgr credentials by URL scheme - #155696
Conversation
Documentation build overview
15 files changed ·
|
| return (scheme or None, *self.reduce_uri(uri, default_port)) | ||
|
|
||
| def _is_suburi_with_scheme(self, base, test): | ||
| if (base[0] is not None and test[0] is not None and |
There was a problem hiding this comment.
This only compares the scheme if both are non-None, is that correct? Or should it check the scheme regardless of whether each is None?
There was a problem hiding this comment.
Yes, that's intentional, both None cases matter.
test[0] is not None needed here because of ProxyBasicAuthHandler.http_error_407 which queries by req.host.
Maybe it's makes sense to add this to add_password documentation.
There was a problem hiding this comment.
Added it to the documentation. I'll fully understand if you'll say that the two sentences are confusing.
If a URI includes a scheme, its credentials only match authentication URIs with the same scheme or no scheme.
A URI without a scheme matches authentication URIs with any scheme.
Feel free to edit it yourself or post a suggestion.
3 participants
Fixes #155694.
Scope HTTPPasswordMgr credentials by URL scheme. This prevents a situation where credentials stored for an HTTPS URL match a corresponding HTTP URL. URIs without a scheme will still match any scheme.
HTTPPasswordMgrcan send saved HTTPS credentials via HTTP because of incorrect scheme matching #155694