Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't send Authorization headers to third-party services. #562

Merged
merged 1 commit into from
Feb 6, 2024

Commits on Feb 5, 2024

  1. Don't send Authorization headers to third-party services.

    We may have been directed away from github.com (via
    follow_location_to_data()), and for security reasons it's important that
    we don't leak our GitHub credentials.
    
    If an artifact is uploaded with actions/upload-artifact@v4, calls may be
    redirected to a URL starting with
    https://productionresultssa0.blob.core.windows.net/. Requests made to
    download that file will be rejected if they contain an Authorization
    header.
    korran committed Feb 5, 2024
    Configuration menu
    Copy the full SHA
    d0b9094 View commit details
    Browse the repository at this point in the history