mapbox / mapbox/mapbox-maps-android
Upon on redirect(301) authentication header doesn't get removed
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 578
- Forks
- 161
- PR merge metrics
- No merged PRs in 30d
Description
## Environment
- Android OS version: 15
- Devices affected:
- Maps SDK Version: 11.8.1
## Observed behavior and steps to reproduce
The http stack used in Mapbox does not strip out Authentication header upon on receiving a redirect (301). This is a huge security risk as the authentication token is leaked to 3rd party.
## Expected behavior
Authentication header should be removed upon on redirect
## Notes / preliminary analysis
## Additional links and references
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the Mapbox HTTP stack's handling of 301 redirects on Android with Maps SDK 11.8.1, then reproduce the reported authentication-header behavior. Done means the authentication header is removed before a redirected request reaches a third party, with a regression test covering the redirect case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100