Repository navigation
[Hackathon] fix(http): a redirect forwards the API key to the next host #446
Description
Verified against (commit SHA or released version)
commit 988c035 (main HEAD)
Discord Username / User ID
ololadestephen
What does this improvement do?
HttpClient calls fetch in src/lib/http.ts with no redirect option, so Node follows redirects. The API key is sent as the custom header x-api-key. Node strips Authorization on a cross-origin redirect, but it forwards x-api-key.
Verified with Node's own fetch: a 302 from one local port to another delivered x-api-key to the second server.
The CLI is supposed to talk only to the configured API endpoint. A redirect from that host, or from a proxy in front of it, sends the key to the next host.
Fix: do not follow a cross-origin redirect. Same-host redirects can still be followed. Add a test that a 302 to another origin does not receive x-api-key.
Details / implementation notes
The fetch call is in requestWithMeta (src/lib/http.ts, around the this.fetchImpl(url, …) call). buildHeaders sets x-api-key on every authenticated request. No new dependency.
Confirmations
- I have searched existing issues and this is not a duplicate.
- I have provided my Discord identity above for reward coordination.
Activity
fyZhang66 commentedon Oct 20, 2026
Confirmed on v0.15.0, thanks @Ololadestephen.
fetchinhttp.tsfollows redirects with default settings, andx-api-keyis a custom header, so a cross-origin 302 carries the key to the next host. No user has hit this (our API never redirects cross-origin), but it is a one-line hardening. Accepted, scope:redirect: 'error'on the shared client (or follow same-origin redirects only); a cross-origin redirect becomes a typed transport error naming both hosts.We'll review #500 against this. No new dependency.
Ololadestephen commentedon Oct 20, 2026
/assign
testsprite-hob commentedon Oct 20, 2026
Assigned to @Ololadestephen. Thanks for taking this on. (2 more slots available.)
Your open assigned issues (1/3):
(none)
Ololadestephen commentedon Oct 20, 2026
@fyZhang66 Thanks for confirming and accepting this. I’ve claimed the issue and will implement the scoped fix and regression tests. One clarification: you mentioned reviewing #500 against this issue, but its title concerns the raw API command. Is #500 the intended reference, or should I open a separate PR for #446?
fyZhang66 commentedon Oct 20, 2026
@Ololadestephen my bad #500 is unrelated, let's open a seperate pr for this issue, thank you.