search

barnacs / compy

HTTP/HTTPS compression proxy
ISC License
204 stars 34 forks source link

[Security] Don't leak proxy credentials to target website #46

Closed ggramaize closed 5 years ago

ggramaize commented 5 years ago

Hi,

In the unpatched version, the Proxy-Authorization header is leaked to the target website. This poses a security threat, as the chosen authentication scheme would enable a rogue target to get valid proxy credentials.

Moreover, as told in RFC7235, section 4.4:

Unlike Authorization, the Proxy-Authorization header field applies only to the next inbound proxy that demanded authentication using the Proxy-Authenticate field. [...] A proxy MAY relay the credentials from the client request to the next proxy if that is the mechanism by which the proxies cooperatively authenticate a given request.

Kind regards

gaul commented 5 years ago

Thank you for your contribution @ggramaize!