romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-02 08:50:28 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: clear digest nonce on cross-orgin redirect

Browse source 
Verify in test 1966

Reported-by: Yalguun Tumenkhuu
Closes #21359
This commit is contained in:
Daniel Stenberg 2026-04-17 16:25:26 +02:00
parent 97cf21acd2
commit 6daf4bc7e2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 123 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/http.c
View file

@ -1245,6 +1245,11 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
same_origin = Curl_url_same_origin(u, data->state.uh);
curl_url_cleanup(u);
#ifndef CURL_DISABLE_DIGEST_AUTH
if(!same_origin)
Curl_auth_digest_cleanup(&data->state.digest);
#endif
if((!same_origin && !data->set.allow_auth_to_other_hosts) ||
!data->set.str[STRING_USERNAME]) {
result = Curl_reset_userpwd(data);