[security feature] Require explicit opt-in for allowing redirect http->https

Open
#1,879 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Active
Tech stack
python
Domain
api, security

Research direction

No file or test is identified in the issue. Start by locating the HTTP redirect handling and its existing tests, then determine how the opt-in setting is exposed and verify that the default rejects the redirect while an explicit opt-in preserves it.

Written by the indexing model from the issue text.

Description

enhancement needs investigation

This redirect is a required feature for some enterprise networks, but it's also raised as a security hole by some reviews. We should do an active switch to making it fail by default and allow users to specify the behavior if needed.

Dominant language
Python
Stars
716
Forks
446
Avg merge
8d 8h
Merged PRs (30d)
2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from tableau/server-client-python

All issues in tableau/server-client-python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.