Skip to content

Vulnerability in follow-redirects

Erwan Rouchet requested to merge vuln-follow-redirects into master

https://github.com/advisories/GHSA-pw2r-vq6v-hr8c

Redirecting from https://arkindex.teklia.com to http://arkindex.teklia.com could cause the Authorization header to be sent unencrypted via Axios. We don't redirect, we don't HTTP, and we do not only use the Authorization header since the CSRF token is required.

Edited by Erwan Rouchet

Merge request reports