From 54aaf333cfe59f62d01ed06c8951da268ab2fb18 Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Tue, 19 May 2026 01:23:00 +0100 Subject: [PATCH] Drop cookies on redirect (#12550) (#12640) CVE: CVE-2026-47265 Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478] (cherry picked from commit d57efb05f5073071ceb2d3b35d72d9d0bc4512a2) (cherry picked from commit f54c40851b0d6c4bbdab97ba518a223adda32478) Signed-off-by: Darsh Kelaiya --- CHANGES/12540.bugfix.rst | 1 + aiohttp/client.py | 1 + tests/test_client_functional.py | 16 ++++++++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 CHANGES/12540.bugfix.rst diff --git a/CHANGES/12540.bugfix.rst b/CHANGES/12540.bugfix.rst new file mode 100644 index 000000000..dfd98129e --- /dev/null +++ b/CHANGES/12540.bugfix.rst @@ -0,0 +1 @@ +Fixed per-request ``cookies`` not being dropped on cross-origin redirects -- by :user:`Dreamsorcerer`. diff --git a/aiohttp/client.py b/aiohttp/client.py index 5d10d3e43..0637eff6b 100644 --- a/aiohttp/client.py +++ b/aiohttp/client.py @@ -892,6 +892,7 @@ class ClientSession: if url.origin() != redirect_origin: auth = None + cookies = None headers.pop(hdrs.AUTHORIZATION, None) headers.pop(hdrs.COOKIE, None) headers.pop(hdrs.PROXY_AUTHORIZATION, None) diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py index 118ce19ca..ea31567c4 100644 --- a/tests/test_client_functional.py +++ b/tests/test_client_functional.py @@ -3564,8 +3564,20 @@ async def test_auth_persist_on_redirect_to_other_host_with_global_auth( async with aiohttp.ClientSession( connector=connector, auth=aiohttp.BasicAuth("user", "pass") ) as client: - resp = await client.get(url_from) - assert resp.status == 200 + async with client.get( + url_from, + headers={ + "Proxy-Authorization": "Basic dXNlcjpwYXNz", + "Cookie": "a=b", + }, + ) as resp: + assert resp.status == 200 + async with client.get( + url_from, + headers={"Proxy-Authorization": "Basic dXNlcjpwYXNz"}, + cookies={"a": "b"}, + ) as resp: + assert resp.status == 200 async def test_drop_auth_on_redirect_to_other_host_with_global_auth_and_base_url(