title: Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http
description: When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
problem types: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
affected:
{
vendor: Go standard library
product: net/http
collectionURL: https://pkg.go.dev
packageName: net/http
versions:
version: 0, lessThan: 1.21.8, status: affected, versionType: semver
version: 1.22.0-0, lessThan: 1.22.1, status: affected, versionType: semver
programRoutines:
name: isDomainOrSubdomain
name: Client.Do
name: Client.Get
name: Client.Head
name: Client.Post
name: Client.PostForm
name: Get
name: Head
name: Post
name: PostForm
defaultStatus: unaffected
}
{
vendor: Go standard library
product: net/http/cookiejar
collectionURL: https://pkg.go.dev
packageName: net/http/cookiejar
versions:
version: 0, lessThan: 1.21.8, status: affected, versionType: semver
version: 1.22.0-0, lessThan: 1.22.1, status: affected, versionType: semver
programRoutines:
name: isIP
name: Jar.Cookies
name: Jar.SetCookies
defaultStatus: unaffected
}
