http.rb 1.3.6 → 1.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 198e221dc9a1ced43833cfa01886896755615ccc22d9773d0798627d0af1bd45
-  data.tar.gz: 53d2e227daa4558d0f810980e2b86ec60fa17c4222c2e61e507c164097c25071
+  metadata.gz: 5cab4dfd9757c08463389bff8595489378a59ecb3149cbdfcc465ab6a508536e
+  data.tar.gz: 5fe112a78858fc9deee9a1b8ab29cf71325a7e0801fd6b6d33e3f48835aba2dd
 SHA512:
-  metadata.gz: 2ef160053a5a5069e6be6714daf9229358ece7af8899ec0f5fcc8b98f9b5b4cb05c434d0c3a5a946f7e95a66cf55e19feb918f8096f8793b0bbc25780bd8545a
-  data.tar.gz: 0a9721b58212b93670c368496c50bc19f7ea4d53d1b860728b6a3fd5ff8b2d7f81d388cee42a6f969bd65c5ca5584d126d75e1fb5092e35372312e32593c6cd7
+  metadata.gz: a9678a45ae024d10874c9fdd9781e785b64f2e9818c85cc991b7af6bff8f56d38d3cad1f53d606bf36ff758581a1c2106e3b38c5f88224aa6d5272833ee97482
+  data.tar.gz: 8f9c36f7f2496a752c55a3352eb867585e787d72d63e87c8a124576b849517e213bd997d92415d2819eaac3f21a47099bef2f3a2f8e85e473aea6d8a3c9ab560

data/CHANGELOG

@@ -1,5 +1,31 @@
 # CHANGELOG
 
+## 20261011
+
+1.3.8: Headers are carried through a 301, 302, or 303.
+
+A 301, 302, or 303 was followed with no headers at all, so a User-Agent, an Accept, or a Cookie given to the request was not sent to where it was redirected, whereas a 307 or 308 sent them all. Now every redirect carries them, less the credentials which 1.3.6 keeps to their origin, and less Content-Type where the request is made a GET, there being no body for it to describe.
+
+1. ~ HTTP.redirect_headers: + drop_content_type:, which leaves Content-Type behind.
+2. ~ HTTP.request: a 301, 302, or 303 is followed with redirect_headers, dropping Content-Type, rather than with no headers.
+3. ~ test/HTTP/REDIRECT_test.rb: + headers carried through each of 301, 302, 303, 307, and 308, and Content-Type left behind when a POST becomes a GET; credentials dropped for another origin by 301, 302, and 303 as well as by 307 and 308. The 301, 302, and 303 examples fail against 1.3.7.
+4. ~ README.md: + Redirections, on what is carried through a redirect and what is not.
+5. ~ HTTP::VERSION: /1.3.7/1.3.8/
+
+
+## 20261011
+
+1.3.7: The options hash is no longer altered, so no_redirect, retries, and basic authentication survive a call and a redirect.
+
+HTTP.request took no_redirect, username, password, and the retry options out of the caller's hash with delete. A hash passed twice had lost no_redirect by the second call, which then followed the redirect it was asked not to. And the redirect was made with what was left of the hash, so retries and basic authentication were lost at the first redirect, even to the same origin.
+
+1. ~ HTTP.request: works on a copy of the options hash, leaving the caller's as it was.
+2. ~ HTTP.request: a redirect is made with the options as given, less what goes no further than the origin.
+3. ~ lib/HTTP/REDIRECT.rb: + HTTP.redirect_options, which drops username and password where a redirect goes to another origin, as 1.3.6 does the credential headers.
+4. ~ test/HTTP/REDIRECT_test.rb: + the options hash left as it was, no_redirect kept for a second call, retries kept after a redirect, and basic authentication kept for the same origin and dropped for another. All but the last fail against 1.3.6, which dropped it for every origin.
+5. ~ HTTP::VERSION: /1.3.6/1.3.7/
+
+
 ## 20261011
 
 1.3.6: Authorization and Cookie headers go no further than the origin they were given to.

data/README.md

@@ -93,6 +93,10 @@ HTTP.get('http://alice:secret@example.com')
 
 When both are supplied, the options hash wins.
 
+### Redirections
+
+Redirects are followed with the headers they were given, except that `Authorization` and `Cookie`, and the `username:` and `password:` options, go no further than the origin (scheme, host, and port) they were given to. Where a redirect makes the request a GET, `Content-Type` is left behind, there being no body for it to describe.
+
 ### Preventing redirections
 
 ```ruby

data/lib/HTTP/REDIRECT.rb

@@ -12,9 +12,18 @@ module HTTP
   module_function :same_origin?
 
   # Credentials are for the origin they were given to, so they go no further than it.
-  def redirect_headers(headers, from_uri, to_uri)
-    return headers if same_origin?(from_uri, to_uri)
-    headers.reject{|k, v| REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase)}
+  # A request made into a GET has no body for a Content-Type to describe.
+  def redirect_headers(headers, from_uri, to_uri, drop_content_type: false)
+    headers.reject do |k, v|
+      (drop_content_type && k.downcase == 'content-type') ||
+        (!same_origin?(from_uri, to_uri) && REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase))
+    end
   end
   module_function :redirect_headers
+
+  def redirect_options(options, from_uri, to_uri)
+    return options if same_origin?(from_uri, to_uri)
+    options.reject{|k, v| %i{username password}.include?(k)}
+  end
+  module_function :redirect_options
 end

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.3.6'
+  VERSION = '1.3.8'
 end

data/lib/HTTP/request.rb

@@ -16,6 +16,8 @@ module HTTP
   def request(uri, request_object, headers = {}, options = {}, &block)
     uri = uri.is_a?(URI) ? uri : URI.parse(uri)
     http = Net::HTTP.new(uri.host, uri.port)
+    given_options = options
+    options = options.dup
     no_redirect = options.delete(:no_redirect)
     username = options.delete(:username)
     password = options.delete(:password)
@@ -45,11 +47,12 @@ module HTTP
         return response
       end
       redirect_uri = uri.merge(response['location'])
+      onward_options = redirect_options(given_options, uri, redirect_uri)
       if response.code =~ /^30[78]$/
         data = METHODS::WITH_BODY.include?(request_method) ? request_object.body : {}
-        response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), options, &block)
+        response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), onward_options, &block)
       else
-        response = get(redirect_uri.to_s, {}, {}, options, &block)
+        response = get(redirect_uri.to_s, {}, redirect_headers(headers, uri, redirect_uri, drop_content_type: true), onward_options, &block)
       end
     end
     if block_given?

data/test/HTTP/REDIRECT_test.rb

@@ -7,6 +7,23 @@ describe "redirect behaviour" do
   let(:same_origin_uri){'http://example.com/elsewhere'}
   let(:other_origin_uri){'http://redirected.com/path'}
 
+  describe "headers" do
+    %w{301 302 303 307 308}.each do |code|
+      it "are carried through a #{code}" do
+        stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
+        stub_request(:get, other_origin_uri).with(headers: {'User-Agent' => 'Redback', 'Accept' => 'text/html'}).to_return(status: 200)
+        _(HTTP.get(uri, {}, {'User-Agent' => 'Redback', 'Accept' => 'text/html'}).success?).must_equal(true)
+      end
+    end
+
+    it "leave Content-Type behind when a POST becomes a GET" do
+      stub_request(:post, uri).to_return(status: 303, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).to_return(status: 200)
+      HTTP.post(uri, {a: 1}, {'Content-Type' => 'application/json', 'User-Agent' => 'Redback'})
+      assert_requested(:get, same_origin_uri){|request| !request.headers.key?('Content-Type') && request.headers['User-Agent'] == 'Redback'}
+    end
+  end
+
   describe "credentials" do
     it "are kept for the same origin" do
       stub_request(:get, uri).to_return(status: 307, headers: {'location' => same_origin_uri})
@@ -14,7 +31,7 @@ describe "redirect behaviour" do
       _(HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).success?).must_equal(true)
     end
 
-    %w{307 308}.each do |code|
+    %w{301 302 303 307 308}.each do |code|
       it "are dropped for another origin via #{code}" do
         stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
         stub_request(:get, other_origin_uri).to_return(status: 200)
@@ -37,4 +54,46 @@ describe "redirect behaviour" do
       assert_requested(:get, 'http://example.com:8080/path'){|request| !request.headers.key?('Cookie')}
     end
   end
+
+  describe "the options hash" do
+    it "is not altered by a call" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).to_return(status: 200)
+      options = {no_redirect: false, username: 'alice', password: 'secret', retries: 1}
+      HTTP.get(uri, {}, {}, options)
+      _(options).must_equal({no_redirect: false, username: 'alice', password: 'secret', retries: 1})
+    end
+
+    it "keeps no_redirect for a second call" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => other_origin_uri})
+      options = {no_redirect: true}
+      HTTP.get(uri, {}, {}, options)
+      _(HTTP.get(uri, {}, {}, options).redirection?).must_equal(true)
+      assert_not_requested(:get, other_origin_uri)
+    end
+
+    it "keeps retrying after a redirect" do
+      HTTP::RETRY.stub(:sleep, nil) do
+        stub_request(:get, uri).to_return(status: 302, headers: {'location' => same_origin_uri})
+        stub_request(:get, same_origin_uri).to_return(status: 503).then.to_return(status: 200)
+        _(HTTP.get(uri, {}, {}, {retries: 1}).success?).must_equal(true)
+        assert_requested(:get, same_origin_uri, times: 2)
+      end
+    end
+  end
+
+  describe "basic authentication options" do
+    it "are kept for the same origin" do
+      stub_request(:get, uri).with(basic_auth: ['alice', 'secret']).to_return(status: 302, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).with(basic_auth: ['alice', 'secret']).to_return(status: 200)
+      _(HTTP.get(uri, {}, {}, {username: 'alice', password: 'secret'}).success?).must_equal(true)
+    end
+
+    it "are dropped for another origin" do
+      stub_request(:get, uri).with(basic_auth: ['alice', 'secret']).to_return(status: 307, headers: {'location' => other_origin_uri})
+      stub_request(:get, other_origin_uri).to_return(status: 200)
+      HTTP.get(uri, {}, {}, {username: 'alice', password: 'secret'})
+      assert_requested(:get, other_origin_uri){|request| !request.headers.key?('Authorization')}
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.3.6
+  version: 1.3.8
 platform: ruby
 authors:
 - thoran