python-websockets / websockets

Library for building WebSocket servers and clients in Python

https://websockets.readthedocs.io/

BSD 3-Clause "New" or "Revised" License

5.16k stars 513 forks source link

Disallow cross-origin redirect when host, port, path or sock is set. (#631) #1444

Closed SLiV9 closed 3 weeks ago

SLiV9 commented 7 months ago

This fixes #631.

aaugustin commented 3 weeks ago

I'm not going to fix this in the legacy implementation.

1495 gets it right in the new asyncio implementation.

It's also a bit smarter e.g. it supports same-origin redirects when host and port are overridden, which is OK. This PR breaks that use case, which could be considered as a regression by users.