follow-redirects - npm Package Compare versions

Comparing version 1.14.7 to 1.14.8

index.js

@@ -395,4 +395,5 @@ var url = require("url");
 
-    // Drop the confidential headers when redirecting to another domain
-    if (!(redirectUrlParts.host === currentHost || isSubdomainOf(redirectUrlParts.host, currentHost))) {
+    // Drop confidential headers when redirecting to another scheme:domain
+    if (redirectUrlParts.protocol !== currentUrlParts.protocol ||
+       !isSameOrSubdomain(redirectUrlParts.host, currentHost)) {
       removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);
@@ -563,3 +564,6 @@ }
 
-function isSubdomainOf(subdomain, domain) {
+function isSameOrSubdomain(subdomain, domain) {
+  if (subdomain === domain) {
+    return true;
+  }
   const dot = subdomain.length - domain.length - 1;
@@ -566,0 +570,0 @@ return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);

package.json

 {
   "name": "follow-redirects",
-  "version": "1.14.7",
+  "version": "1.14.8",
   "description": "HTTP and HTTPS modules that follow redirects.",
@@ -5,0 +5,0 @@ "license": "MIT",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

26615

increased by0.32%

Lines of code

529

increased by0.76%

No dependency changes