mirror of https://github.com/zulip/zulip.git
291197976a
We currently redirect all unencrypted HTTP requests to HTTPS in NGINX. While this is reasonable for browser-based environments, which generally segregate HTTP and HTTPS cookies (ensuring that client secrets are not leaked in the HTTP request), this poses an security risk for API clients. Specifically, an API client which is configured to auto-follow redirects may send an API key in cleartext, and then _silently_ follow the 301 redirect provided by NGINX, leaving the user blind to the fact that their credentials were exposed in cleartext. Stop redirecting unencrypted API requests, and provide clients with a clear message alerting them to the fact that credentials were potentially exposed. Fixes: #30264. |
||
|---|---|---|
| .. | ||
| kandra | ||
| zulip | ||
| deps.yaml | ||