mirror of
https://github.com/aphrody-labs/PowerShell.git
synced 2026-10-15 06:09:09 +00:00
Patrick Meinecke
0c59ffd113
<!-- Anything that looks like this is a comment and can't be seen after the Pull Request is created. -->
# PR Summary
Web commands currently preserve `Authorization` headers when either the `FollowRelLinks` parameter or the `PreserveHttpMethodOnRedirect` parameter is specified. This should only occur when `PreserveAuthorizationOnRedirect` is specified. This change fixes that.
<!-- Summarize your PR between here and the checklist. -->
## PR Context
<!-- Provide a little reasoning as to why this Pull Request helps and why you have opened it. -->
## PR Checklist
- [x] [PR has a meaningful title](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- Use the present tense and imperative mood when describing your changes
- [x] [Summarized changes](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [x] [Make sure all `.h`, `.cpp`, `.cs`, `.ps1` and `.psm1` files have the correct copyright header](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [x] This PR is ready to merge. If this PR is a work in progress, please open this as a [Draft Pull Request and mark it as Ready to Review when it is ready to merge](https://docs.github.com/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests#draft-pull-requests).
- **[Breaking changes](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#making-breaking-changes)**
- [ ] None
- **OR**
- [x] This is a breaking change, but cannot be made experimental.
- [ ] [Experimental feature(s) needed](https://github.com/MicrosoftDocs/PowerShell-Docs/blob/main/reference/7.5/Microsoft.PowerShell.Core/About/about_Experimental_Features.md)
- [ ] Experimental feature name(s): <!-- Experimental feature name(s) here -->
- **User-facing changes**
- [ ] Not Applicable
- **OR**
- [x] [Documentation needed](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [ ] Issue filed: <!-- Number/link of that issue here -->
- **Testing - New and feature**
- [ ] N/A or can only be tested interactively
- **OR**
- [x] [Make sure you've added a new test if existing tests do not effectively test the code changed](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#before-submitting)
----
#### AI description (iteration 1)
#### PR Classification
Security bug fix to strip authorization headers during HTTP redirects unless explicitly preserved with the `-PreserveAuthorizationOnRedirect` parameter.
#### PR Summary
This PR fixes a security vulnerability where authorization headers were incorrectly being preserved during HTTP redirects by default. The changes ensure authorization headers are now stripped on redirects unless the `-PreserveAuthorizationOnRedirect` switch is explicitly specified.
-...