Commit ae6b354
Implement custom redirect handling to fix lost Set-Cookie on redirects (#2360)
* Implement custom redirect handling to fix lost Set-Cookie on redirects
Fixes #2077 and #2059. Previously RestSharp delegated redirects to
HttpClient (AllowAutoRedirect=true) but set UseCookies=false, so
Set-Cookie headers from intermediate redirect responses were silently
lost. This replaces HttpClient's redirect handling with a custom loop
in ExecuteRequestAsync that processes Set-Cookie at each hop.
Adds RedirectOptions class with fine-grained control over redirect
behavior: FollowRedirectsToInsecure, ForwardHeaders, ForwardAuthorization,
ForwardCookies, ForwardBody, ForwardQuery, MaxRedirects, and
RedirectStatusCodes. Existing FollowRedirects/MaxRedirects properties
delegate to RedirectOptions for backward compatibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Address PR review feedback: reduce complexity, fix disposal, fix duplicate cookies
- Extract redirect loop into smaller focused methods (SendWithRedirectsAsync,
ShouldFollowRedirect, ResolveRedirectUrl, CreateRedirectMessage,
ParseResponseCookies, AddPendingCookies) to reduce cognitive complexity
- Fix double-dispose warning (S3966) by using previousMessage pattern
and try/finally for message disposal in SendWithRedirectsAsync
- Fix duplicate Cookie header bug in AddCookieHeaders (remove existing
parameter before adding merged cookies)
- Add Host/CacheControl headers to redirect request messages
- Add comments for intentional cert validation bypass in HTTPS tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Reduce test code duplication flagged by SonarCloud
- Move shared test endpoints (set-cookie-and-redirect, echo-cookies,
redirect-no-query, redirect-custom-status) into WireMockTestServer
- Switch CookieRedirectTests to use IClassFixture<WireMockTestServer>
instead of standalone WireMockServer, eliminating cross-file duplication
- Parameterize verb change tests with [Theory]/[InlineData] (5 tests → 1)
- Parameterize header, auth, query, and HTTPS tests with [Theory]
- Extract CreateClient helper to reduce setup boilerplate
- CookieRedirectTests: 616 → 336 lines (45% reduction)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Strip Authorization header on cross-origin and HTTPS-to-HTTP redirects
Address security concern from PR review: ForwardAuthorization could
leak credentials to unintended hosts on redirect.
- Compare full authority (host+port) against original request URL,
matching browser same-origin policy
- Always strip Authorization on HTTPS→HTTP redirects (defense-in-depth)
- Add ForwardAuthorizationToExternalHost option (default false) for
explicit opt-in to cross-origin auth forwarding
- Add tests for cross-host auth stripping and explicit opt-in
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Consolidate cross-host auth tests into parameterized Theory to reduce duplication
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Reduce code duplication: consolidate ForwardBody tests and reuse shared EchoRequest
- Merge ForwardBody_False and ForwardBody_True into a single parameterized Theory
- Replace inline echo-request callback with shared WireMockTestServer.EchoRequest
- Make EchoRequest public for cross-project reuse
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>1 parent 91dfd97 commit ae6b354
File tree
8 files changed
+817
-50
lines changed- src/RestSharp
- Options
- Request
- test
- RestSharp.Tests.Integrated
- RestSharp.Tests
8 files changed
+817
-50
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
108 | 108 | | |
109 | 109 | | |
110 | 110 | | |
111 | | - | |
| 111 | + | |
| 112 | + | |
112 | 113 | | |
113 | 114 | | |
114 | 115 | | |
115 | 116 | | |
116 | | - | |
| 117 | + | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
117 | 124 | | |
118 | 125 | | |
119 | 126 | | |
| |||
141 | 148 | | |
142 | 149 | | |
143 | 150 | | |
| 151 | + | |
| 152 | + | |
| 153 | + | |
| 154 | + | |
| 155 | + | |
| 156 | + | |
| 157 | + | |
| 158 | + | |
| 159 | + | |
| 160 | + | |
144 | 161 | | |
145 | | - | |
| 162 | + | |
146 | 163 | | |
147 | 164 | | |
148 | 165 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
35 | 35 | | |
36 | 36 | | |
37 | 37 | | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
38 | 43 | | |
39 | 44 | | |
40 | 45 | | |
| |||
48 | 53 | | |
49 | 54 | | |
50 | 55 | | |
| 56 | + | |
51 | 57 | | |
52 | 58 | | |
53 | 59 | | |
| |||
0 commit comments