From acf4498381cfd4dbaa2a2de6d868eb2f71bfb2b1 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Sat, 25 Jul 2026 23:48:07 +0200 Subject: [PATCH] http: fix httpsig with auth-redir Do not let unrelated credentials from a redirected URL bypass the cross-host auth boundary Verified by test 5023 to 5025 Follow-up to a55731050e8c3dbea0 Closes #22395 --- lib/http.c | 15 +++++++--- tests/data/Makefile.am | 3 +- tests/data/test5023 | 66 ++++++++++++++++++++++++++++++++++++++++ tests/data/test5024 | 68 ++++++++++++++++++++++++++++++++++++++++++ tests/data/test5025 | 66 ++++++++++++++++++++++++++++++++++++++++ 5 files changed, 213 insertions(+), 5 deletions(-) create mode 100644 tests/data/test5023 create mode 100644 tests/data/test5024 create mode 100644 tests/data/test5025 diff --git a/lib/http.c b/lib/http.c index d8bac2e5cc..c8c0084233 100644 --- a/lib/http.c +++ b/lib/http.c @@ -672,10 +672,17 @@ static CURLcode output_auth_headers(struct Curl_easy *data, #endif #ifndef CURL_DISABLE_HTTPSIG if((authstatus->picked == CURLAUTH_HTTPSIG) && !proxy) { - auth = "HTTPSIG"; - result = Curl_output_httpsig(data); - if(result) - return result; + /* HTTPSIG uses its own configured key material rather than + data->state.creds. Do not let unrelated credentials from a + redirected URL bypass the cross-host auth boundary. */ + if(Curl_auth_allowed_to_host(data)) { + auth = "HTTPSIG"; + result = Curl_output_httpsig(data); + if(result) + return result; + } + else + authstatus->done = TRUE; } else #endif diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am index 209cc43598..728858dafa 100644 --- a/tests/data/Makefile.am +++ b/tests/data/Makefile.am @@ -294,7 +294,8 @@ test4000 test4001 \ \ test5000 test5001 test5002 test5003 test5004 test5005 test5006 test5007 \ test5008 test5009 test5010 test5011 test5012 test5013 test5014 test5015 \ -test5016 test5017 test5018 test5019 test5020 test5021 test5022 +test5016 test5017 test5018 test5019 test5020 test5021 test5022 test5023 \ +test5024 test5025 EXTRA_DIST = $(TESTCASES) DISABLED data-xml1 \ data1461.txt data1463.txt \ diff --git a/tests/data/test5023 b/tests/data/test5023 new file mode 100644 index 0000000000..1d59c23994 --- /dev/null +++ b/tests/data/test5023 @@ -0,0 +1,66 @@ + + + + +HTTP +httpsig +RFC9421 + + + +# Server-side + + +HTTP/1.1 301 OK +Content-Length: 0 +Location: http://example.org:9000/%TESTNUMBER0002 + + + +HTTP/1.1 200 OK +Date: Tue, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake +Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT +Content-Length: 6 +Connection: close +Content-Type: text/html + +-foo- + + + +# Client-side + + +http + + +Debug +httpsig + + +HTTP Message Signature with cross-origin redirect + + +"http://example.com:8000/%TESTNUMBER/resource?action=read" --httpsig-algo "ed25519" --httpsig-key @%SRCDIR/data/data-httpsig-ed25519.key --httpsig-keyid "my-key-1" --connect-to example.com:8000:%HOSTIP:%HTTPPORT --connect-to example.org:9000:%HOSTIP:%HTTPPORT --location + + + +# Verify data after the test has been "shot" + + +GET /%TESTNUMBER/resource?action=read HTTP/1.1 +Host: example.com:8000 +Signature-Input: sig1=("@method" "@authority" "@path" "@query");created=0;keyid="my-key-1";alg="ed25519" +Signature: sig1=:faTRQjDfWWm39STQkXyafoAp6ee2FCPh2KMefXOB51WAvoOdc6/Uwp9LW4zNWI7r+ivTKY7oSDb5kqcPJ/aSAQ==: +User-Agent: curl/%VERSION +Accept: */* + +GET /%TESTNUMBER0002 HTTP/1.1 +Host: example.org:9000 +User-Agent: curl/%VERSION +Accept: */* + + + + diff --git a/tests/data/test5024 b/tests/data/test5024 new file mode 100644 index 0000000000..930b0de65d --- /dev/null +++ b/tests/data/test5024 @@ -0,0 +1,68 @@ + + + + +HTTP +httpsig +RFC9421 + + + +# Server-side + + +HTTP/1.1 301 OK +Content-Length: 0 +Location: /%TESTNUMBER0002 + + + +HTTP/1.1 200 OK +Date: Tue, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake +Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT +Content-Length: 6 +Connection: close +Content-Type: text/html + +-foo- + + + +# Client-side + + +http + + +Debug +httpsig + + +HTTP Message Signature with same-origin redirect + + +"http://example.com:8000/%TESTNUMBER/resource?action=read" --httpsig-algo "ed25519" --httpsig-key @%SRCDIR/data/data-httpsig-ed25519.key --httpsig-keyid "my-key-1" --connect-to example.com:8000:%HOSTIP:%HTTPPORT --location + + + +# Verify data after the test has been "shot" + + +GET /%TESTNUMBER/resource?action=read HTTP/1.1 +Host: example.com:8000 +Signature-Input: sig1=("@method" "@authority" "@path" "@query");created=0;keyid="my-key-1";alg="ed25519" +Signature: sig1=:pxRrwEySHVgwXOI93y5KxKytfoXU6leQpC7i82Uodh8+oI7ycqCogD4PUU1p0RUAzoqeT2RHVWIN7Qg3k4A9DQ==: +User-Agent: curl/%VERSION +Accept: */* + +GET /%TESTNUMBER0002 HTTP/1.1 +Host: example.com:8000 +Signature-Input: sig1=("@method" "@authority" "@path");created=0;keyid="my-key-1";alg="ed25519" +Signature: sig1=:QVx0WyxuyHqb3j0YihCLaWYdZOySKoIezj6FmTzsJprSqgm6yUsFbcWek4r6pALF1/jKGwNB1Rbyv3DE/pn/BA==: +User-Agent: curl/%VERSION +Accept: */* + + + + diff --git a/tests/data/test5025 b/tests/data/test5025 new file mode 100644 index 0000000000..10c48073de --- /dev/null +++ b/tests/data/test5025 @@ -0,0 +1,66 @@ + + + + +HTTP +httpsig +RFC9421 + + + +# Server-side + + +HTTP/1.1 301 OK +Content-Length: 0 +Location: http://bob:alice@example.org:9000/%TESTNUMBER0002 + + + +HTTP/1.1 200 OK +Date: Tue, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake +Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT +Content-Length: 6 +Connection: close +Content-Type: text/html + +-foo- + + + +# Client-side + + +http + + +Debug +httpsig + + +HTTP Message Signature with cross-origin + user auth redirect + + +"http://example.com:8000/%TESTNUMBER/resource?action=read" --httpsig-algo "ed25519" --httpsig-key @%SRCDIR/data/data-httpsig-ed25519.key --httpsig-keyid "my-key-1" --connect-to example.com:8000:%HOSTIP:%HTTPPORT --connect-to example.org:9000:%HOSTIP:%HTTPPORT --location + + + +# Verify data after the test has been "shot" + + +GET /%TESTNUMBER/resource?action=read HTTP/1.1 +Host: example.com:8000 +Signature-Input: sig1=("@method" "@authority" "@path" "@query");created=0;keyid="my-key-1";alg="ed25519" +Signature: sig1=:OUXXFiQlk/CEUksEkxvuivcFqWxL3xoPIZhB9FKTrx4MbhQqCRYMT0CQCUA9wCeRGkzmpGComBk5oPwKZr+MDg==: +User-Agent: curl/%VERSION +Accept: */* + +GET /%TESTNUMBER0002 HTTP/1.1 +Host: example.org:9000 +User-Agent: curl/%VERSION +Accept: */* + + + +