Hsnmohd opened a new pull request, #911: URL: https://github.com/apache/httpcomponents-client/pull/911
**Redirect in a CONNECT reply is followed as if the target sent it** `ConnectExec` and `AsyncConnectExec` pass a 3xx reply to CONNECT up the exec chain as the target's response, so the redirect exec follows a Location picked by the proxy: answering `CONNECT bank.example:443` with `307 Location: http://bank.example/login` makes both clients re-send the POST body in cleartext through the proxy and return the proxy's own 200 as the response to the https request (the Pretty-Bad-Proxy issue browsers fixed in 2009, reproduced here with a socket-level fake proxy). These replies, and a non-200 2xx in the classic exec (the async exec already rejects those), now fail with the existing "Unexpected response to CONNECT request" error as `ProxyClient` does, while 4xx/5xx refusals still reach the caller. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
