http.rb 1.3.7 → 1.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d2e0827d0ee0a2f4215eabfd6cd2f952bacb1d12dc657ab1a488ef85a91a46f
-  data.tar.gz: 5d343996ad5cba48c51c9df5c7f0b31895f3a437d8be6cc15d5fdaff64075430
+  metadata.gz: 5cab4dfd9757c08463389bff8595489378a59ecb3149cbdfcc465ab6a508536e
+  data.tar.gz: 5fe112a78858fc9deee9a1b8ab29cf71325a7e0801fd6b6d33e3f48835aba2dd
 SHA512:
-  metadata.gz: 644e855a9c30b1ec23e0f2b3db27850ad9018574b37d1e25bcb63ce3aa11371d81a7a372c56cbd9c8f1a284ecf2cdaa0f7219b331da32c3d2fd3b6f4ea90df73
-  data.tar.gz: 751e3dfc085e8e9c1af0fc372bf948404fd6ac4839eb79ada5d38f390ea9a35ec6ce51381deda5ede866a10f6dafbe208a24ad23b4b15d143fad51a9d557c429
+  metadata.gz: a9678a45ae024d10874c9fdd9781e785b64f2e9818c85cc991b7af6bff8f56d38d3cad1f53d606bf36ff758581a1c2106e3b38c5f88224aa6d5272833ee97482
+  data.tar.gz: 8f9c36f7f2496a752c55a3352eb867585e787d72d63e87c8a124576b849517e213bd997d92415d2819eaac3f21a47099bef2f3a2f8e85e473aea6d8a3c9ab560

data/CHANGELOG

@@ -1,5 +1,18 @@
 # CHANGELOG
 
+## 20261011
+
+1.3.8: Headers are carried through a 301, 302, or 303.
+
+A 301, 302, or 303 was followed with no headers at all, so a User-Agent, an Accept, or a Cookie given to the request was not sent to where it was redirected, whereas a 307 or 308 sent them all. Now every redirect carries them, less the credentials which 1.3.6 keeps to their origin, and less Content-Type where the request is made a GET, there being no body for it to describe.
+
+1. ~ HTTP.redirect_headers: + drop_content_type:, which leaves Content-Type behind.
+2. ~ HTTP.request: a 301, 302, or 303 is followed with redirect_headers, dropping Content-Type, rather than with no headers.
+3. ~ test/HTTP/REDIRECT_test.rb: + headers carried through each of 301, 302, 303, 307, and 308, and Content-Type left behind when a POST becomes a GET; credentials dropped for another origin by 301, 302, and 303 as well as by 307 and 308. The 301, 302, and 303 examples fail against 1.3.7.
+4. ~ README.md: + Redirections, on what is carried through a redirect and what is not.
+5. ~ HTTP::VERSION: /1.3.7/1.3.8/
+
+
 ## 20261011
 
 1.3.7: The options hash is no longer altered, so no_redirect, retries, and basic authentication survive a call and a redirect.

data/README.md

@@ -93,6 +93,10 @@ HTTP.get('http://alice:secret@example.com')
 
 When both are supplied, the options hash wins.
 
+### Redirections
+
+Redirects are followed with the headers they were given, except that `Authorization` and `Cookie`, and the `username:` and `password:` options, go no further than the origin (scheme, host, and port) they were given to. Where a redirect makes the request a GET, `Content-Type` is left behind, there being no body for it to describe.
+
 ### Preventing redirections
 
 ```ruby

data/lib/HTTP/REDIRECT.rb

@@ -12,9 +12,12 @@ module HTTP
   module_function :same_origin?
 
   # Credentials are for the origin they were given to, so they go no further than it.
-  def redirect_headers(headers, from_uri, to_uri)
-    return headers if same_origin?(from_uri, to_uri)
-    headers.reject{|k, v| REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase)}
+  # A request made into a GET has no body for a Content-Type to describe.
+  def redirect_headers(headers, from_uri, to_uri, drop_content_type: false)
+    headers.reject do |k, v|
+      (drop_content_type && k.downcase == 'content-type') ||
+        (!same_origin?(from_uri, to_uri) && REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase))
+    end
   end
   module_function :redirect_headers
 

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.3.7'
+  VERSION = '1.3.8'
 end

data/lib/HTTP/request.rb

@@ -52,7 +52,7 @@ module HTTP
         data = METHODS::WITH_BODY.include?(request_method) ? request_object.body : {}
         response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), onward_options, &block)
       else
-        response = get(redirect_uri.to_s, {}, {}, onward_options, &block)
+        response = get(redirect_uri.to_s, {}, redirect_headers(headers, uri, redirect_uri, drop_content_type: true), onward_options, &block)
       end
     end
     if block_given?

data/test/HTTP/REDIRECT_test.rb

@@ -7,6 +7,23 @@ describe "redirect behaviour" do
   let(:same_origin_uri){'http://example.com/elsewhere'}
   let(:other_origin_uri){'http://redirected.com/path'}
 
+  describe "headers" do
+    %w{301 302 303 307 308}.each do |code|
+      it "are carried through a #{code}" do
+        stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
+        stub_request(:get, other_origin_uri).with(headers: {'User-Agent' => 'Redback', 'Accept' => 'text/html'}).to_return(status: 200)
+        _(HTTP.get(uri, {}, {'User-Agent' => 'Redback', 'Accept' => 'text/html'}).success?).must_equal(true)
+      end
+    end
+
+    it "leave Content-Type behind when a POST becomes a GET" do
+      stub_request(:post, uri).to_return(status: 303, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).to_return(status: 200)
+      HTTP.post(uri, {a: 1}, {'Content-Type' => 'application/json', 'User-Agent' => 'Redback'})
+      assert_requested(:get, same_origin_uri){|request| !request.headers.key?('Content-Type') && request.headers['User-Agent'] == 'Redback'}
+    end
+  end
+
   describe "credentials" do
     it "are kept for the same origin" do
       stub_request(:get, uri).to_return(status: 307, headers: {'location' => same_origin_uri})
@@ -14,7 +31,7 @@ describe "redirect behaviour" do
       _(HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).success?).must_equal(true)
     end
 
-    %w{307 308}.each do |code|
+    %w{301 302 303 307 308}.each do |code|
       it "are dropped for another origin via #{code}" do
         stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
         stub_request(:get, other_origin_uri).to_return(status: 200)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.3.7
+  version: 1.3.8
 platform: ruby
 authors:
 - thoran