@@ -9,6 +9,9 @@ const once = require('once')
9
9
const querystring = require ( 'querystring' )
10
10
const url = require ( 'url' )
11
11
12
+ var flag = false
13
+ var original_host ;
14
+
12
15
const isStream = o => o !== null && typeof o === 'object' && typeof o . pipe === 'function'
13
16
14
17
function simpleGet ( opts , cb ) {
@@ -34,6 +37,13 @@ function simpleGet (opts, cb) {
34
37
opts . headers [ 'content-type' ] = 'application/x-www-form-urlencoded'
35
38
}
36
39
40
+ //getting original host
41
+ if ( ! flag ) {
42
+ original_host = opts . hostname
43
+ //console.log(original_host)
44
+ flag = true
45
+ }
46
+
37
47
if ( body ) {
38
48
if ( ! opts . method ) opts . method = 'POST'
39
49
if ( ! isStream ( body ) ) opts . headers [ 'content-length' ] = Buffer . byteLength ( body )
@@ -51,6 +61,13 @@ function simpleGet (opts, cb) {
51
61
delete opts . headers . host // Discard `host` header on redirect (see #32)
52
62
res . resume ( ) // Discard response
53
63
64
+ var redirect_host = url . parse ( opts . url ) . hostname //getting redirected hostname
65
+ //if redirected host is different than original host then drop cookie header to prevent cookie leak in thirdparty site redirect
66
+ if ( redirect_host !== null && redirect_host !== original_host ) {
67
+ delete opts . headers . cookie ;
68
+ delete opts . headers . authorization ;
69
+ }
70
+
54
71
if ( opts . method === 'POST' && [ 301 , 302 ] . includes ( res . statusCode ) ) {
55
72
opts . method = 'GET' // On 301/302 redirect, change POST to GET (see #35)
56
73
delete opts . headers [ 'content-length' ] ; delete opts . headers [ 'content-type' ]
0 commit comments