Summary
Dio's HTTP/2 adapter may forward sensitive request headers when following a redirect to a different origin. If an application sends authenticated requests with redirect following enabled, the destination server could receive Authorization, Cookie, or Proxy-Authorization credentials.
Dio's HTTP/2 adapter may forward sensitive request headers when following a redirect to a different origin. If an application sends authenticated requests with redirect following enabled, the destination server could receive Authorization, Cookie, or Proxy-Authorization credentials.
Affected context
The issue occurs in applications using Dio's Http2Adapter for authenticated HTTP/2 requests when automatic redirect following is enabled. During cross-origin redirects, the adapter may preserve the original request's complete header map instead of restricting headers to those appropriate for the destination origin.
The issue occurs in applications using Dio's Http2Adapter for authenticated HTTP/2 requests when automatic redirect following is enabled. During cross-origin redirects, the adapter may preserve the original request's complete header map instead of restricting headers to those appropriate for the destination origin.
Exploit preconditions
- Attack surface: HTTP/2 request handling and automatic redirect processing
- Required access: The attacker must control, influence, or operate a server contacted by the application, or otherwise cause it to return a cross-origin redirect
- Trigger point: Redirect handling in
Http2Adapter._fetch - Why exploitation is possible: Request headers are copied to the redirected request without comparing source and destination origins, allowing credential-bearing headers to cross trust boundaries
- Attack surface: HTTP/2 request handling and automatic redirect processing
- Required access: The attacker must control, influence, or operate a server contacted by the application, or otherwise cause it to return a cross-origin redirect
- Trigger point: Redirect handling in
Http2Adapter._fetch - Why exploitation is possible: Request headers are copied to the redirected request without comparing source and destination origins, allowing credential-bearing headers to cross trust boundaries
Why this happens
The underlying bug is failure to enforce origin-aware header handling during redirect processing. The adapter copies the full RequestOptions.headers collection through copyWith and reuses it for the redirected HTTP/2 request without removing sensitive headers when the destination changes. This behavior maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, because authentication and session data may be disclosed to an unintended origin.
The underlying bug is failure to enforce origin-aware header handling during redirect processing. The adapter copies the full RequestOptions.headers collection through copyWith and reuses it for the redirected HTTP/2 request without removing sensitive headers when the destination changes. This behavior maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, because authentication and session data may be disclosed to an unintended origin.
Potential impact
- An unintended server may receive Authorization credentials
- Session cookies or other authentication tokens may be exposed
- Proxy-Authorization credentials could be disclosed
- A recipient may impersonate the user or access protected services
- Exposed secrets could support broader account or application compromise
- An unintended server may receive Authorization credentials
- Session cookies or other authentication tokens may be exposed
- Proxy-Authorization credentials could be disclosed
- A recipient may impersonate the user or access protected services
- Exposed secrets could support broader account or application compromise
General mitigation guidance
Mitigation generally focuses on treating redirects as trust-boundary changes and preventing sensitive headers from crossing origins.
Common defensive patterns include:
- Disable automatic redirect following for authenticated requests where practical
- Compare source and destination origins before forwarding any request headers
- Strip Authorization, Cookie, Proxy-Authorization, and equivalent sensitive headers on cross-origin redirects
- Reconstruct redirected requests from an allowlisted set of non-sensitive headers
- Require explicit destination allowlists for redirects involving credentials
- Limit the privileges and scope of credentials used by client applications
Mitigation generally focuses on treating redirects as trust-boundary changes and preventing sensitive headers from crossing origins.
Common defensive patterns include:
- Disable automatic redirect following for authenticated requests where practical
- Compare source and destination origins before forwarding any request headers
- Strip Authorization, Cookie, Proxy-Authorization, and equivalent sensitive headers on cross-origin redirects
- Reconstruct redirected requests from an allowlisted set of non-sensitive headers
- Require explicit destination allowlists for redirects involving credentials
- Limit the privileges and scope of credentials used by client applications
How teams detect issues like this
Organizations can look for:
- Static analysis patterns that copy complete header maps into redirected requests
- Code review signals involving redirect handlers that lack origin comparison
- Tests verifying that sensitive headers are removed when scheme, host, or port changes
- Runtime telemetry for authentication headers appearing in requests to unexpected origins
- Policy checks requiring destination allowlists or explicit redirect controls for authenticated clients
Automated code review and dependency analysis tools may help identify unsafe redirect handling patterns.
Organizations can look for:
- Static analysis patterns that copy complete header maps into redirected requests
- Code review signals involving redirect handlers that lack origin comparison
- Tests verifying that sensitive headers are removed when scheme, host, or port changes
- Runtime telemetry for authentication headers appearing in requests to unexpected origins
- Policy checks requiring destination allowlists or explicit redirect controls for authenticated clients
Automated code review and dependency analysis tools may help identify unsafe redirect handling patterns.
