Do not include auth header when redirecting to other domain

Signed-off-by: Valentin Delaye <jonesbusy@users.noreply.github.com>

Author: jonesbusy

src/main/java/land/oras/auth/HttpClient.java

@@ -33,6 +33,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -150,6 +151,7 @@ public ResponseWrapper<String> get(URI uri, Map<String, String> headers, Scopes
         return executeRequest(
                 "GET",
                 uri,
+                true,
                 headers,
                 new byte[0],
                 HttpResponse.BodyHandlers.ofString(),
@@ -172,6 +174,7 @@ public ResponseWrapper<Path> download(
         return executeRequest(
                 "GET",
                 uri,
+                true,
                 headers,
                 new byte[0],
                 HttpResponse.BodyHandlers.ofFile(file),
@@ -193,6 +196,7 @@ public ResponseWrapper<InputStream> download(
         return executeRequest(
                 "GET",
                 uri,
+                true,
                 headers,
                 new byte[0],
                 HttpResponse.BodyHandlers.ofInputStream(),
@@ -217,6 +221,7 @@ public ResponseWrapper<String> upload(
             return executeRequest(
                     method,
                     uri,
+                    true,
                     headers,
                     new byte[0],
                     HttpResponse.BodyHandlers.ofString(),
@@ -241,6 +246,7 @@ public ResponseWrapper<String> head(
         return executeRequest(
                 "HEAD",
                 uri,
+                true,
                 headers,
                 new byte[0],
                 HttpResponse.BodyHandlers.ofString(),
@@ -262,6 +268,7 @@ public ResponseWrapper<String> delete(
         return executeRequest(
                 "DELETE",
                 uri,
+                true,
                 headers,
                 new byte[0],
                 HttpResponse.BodyHandlers.ofString(),
@@ -284,6 +291,7 @@ public ResponseWrapper<String> post(
         return executeRequest(
                 "POST",
                 uri,
+                true,
                 headers,
                 body,
                 HttpResponse.BodyHandlers.ofString(),
@@ -306,6 +314,7 @@ public ResponseWrapper<String> patch(
         return executeRequest(
                 "PATCH",
                 uri,
+                true,
                 headers,
                 body,
                 HttpResponse.BodyHandlers.ofString(),
@@ -328,6 +337,7 @@ public ResponseWrapper<String> put(
         return executeRequest(
                 "PUT",
                 uri,
+                true,
                 headers,
                 body,
                 HttpResponse.BodyHandlers.ofString(),
@@ -411,6 +421,7 @@ public <T> TokenResponse refreshToken(
     private <T> ResponseWrapper<T> executeRequest(
             String method,
             URI uri,
+            boolean includeAuthHeader,
             Map<String, String> headers,
             byte[] body,
             HttpResponse.BodyHandler<T> handler,
@@ -435,7 +446,8 @@ private <T> ResponseWrapper<T> executeRequest(
 
             // Add authentication header if any
             if (authProvider.getAuthHeader(containerRef) != null
-                    && !authProvider.getAuthScheme().equals(AuthScheme.NONE)) {
+                    && !authProvider.getAuthScheme().equals(AuthScheme.NONE)
+                    && includeAuthHeader) {
                 builder = builder.header(Const.AUTHORIZATION_HEADER, authProvider.getAuthHeader(containerRef));
             }
             headers.forEach(builder::header);
@@ -450,9 +462,22 @@ private <T> ResponseWrapper<T> executeRequest(
             // Follow redirect
             if (shouldRedirect(response)) {
                 String location = getLocationHeader(response);
-                LOG.debug("Redirecting to {}", location);
+                URI redirectUri = URI.create(location);
+                LOG.debug("Redirecting to {} from domain {} to domain {}", location, uri, redirectUri);
+                boolean includeAuthHeaderForRedirect = isSameOrigin(uri, redirectUri);
+                if (!includeAuthHeaderForRedirect) {
+                    LOG.debug("Skipping auth header for redirect from {} to {}", uri, redirectUri);
+                }
                 return executeRequest(
-                        method, URI.create(location), headers, body, handler, bodyPublisher, newScopes, authProvider);
+                        method,
+                        redirectUri,
+                        includeAuthHeaderForRedirect,
+                        headers,
+                        body,
+                        handler,
+                        bodyPublisher,
+                        newScopes,
+                        authProvider);
             }
             return redoRequest(response, builder, handler, newScopes, authProvider);
         } catch (Exception e) {
@@ -461,6 +486,20 @@ private <T> ResponseWrapper<T> executeRequest(
         }
     }
 
+    private static boolean isSameOrigin(URI uri1, URI uri2) {
+        return Objects.equals(uri1.getScheme(), uri2.getScheme())
+                && Objects.equals(uri1.getHost(), uri2.getHost())
+                && getPort(uri1) == getPort(uri2);
+    }
+
+    private static int getPort(URI uri) {
+        int port = uri.getPort();
+        if (port == -1) {
+            return uri.getScheme().equals("https") ? 443 : 80;
+        }
+        return port;
+    }
+
     private <T> boolean shouldRedirect(HttpResponse<T> response) {
         return response.statusCode() == HttpURLConnection.HTTP_MOVED_PERM
                 || response.statusCode() == HttpURLConnection.HTTP_MOVED_TEMP

src/test/java/land/oras/HarborS3ITCase.java

@@ -0,0 +1,48 @@
+/*-
+ * =LICENSE=
+ * ORAS Java SDK
+ * ===
+ * Copyright (C) 2024 - 2025 ORAS
+ * ===
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * =LICENSEEND=
+ */
+
+package land.oras;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import java.nio.file.Path;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.api.parallel.Execution;
+import org.junit.jupiter.api.parallel.ExecutionMode;
+
+@Execution(ExecutionMode.CONCURRENT)
+public class HarborS3ITCase {
+
+    @TempDir
+    Path tempDir;
+
+    @Test
+    @Disabled("Only to test with demo Harbor S3 instance")
+    void shouldPullOneBlob() {
+        Registry registry = Registry.builder().defaults().build();
+        ContainerRef containerRef1 = ContainerRef.parse("demo.goharbor.io/oras/lib:foo");
+        Manifest manifest = registry.getManifest(containerRef1);
+        Layer oneLayer = manifest.getLayers().get(0);
+        registry.fetchBlob(containerRef1.withDigest(oneLayer.getDigest()), tempDir.resolve("my-blob"));
+        assertNotNull(tempDir.resolve("my-blob"));
+    }
+}

src/test/java/land/oras/RegistryWireMockTest.java

@@ -25,7 +25,9 @@
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
+import com.github.tomakehurst.wiremock.WireMockServer;
 import com.github.tomakehurst.wiremock.client.WireMock;
+import com.github.tomakehurst.wiremock.core.WireMockConfiguration;
 import com.github.tomakehurst.wiremock.junit5.WireMockRuntimeInfo;
 import com.github.tomakehurst.wiremock.junit5.WireMockTest;
 import com.github.tomakehurst.wiremock.stubbing.Scenario;
@@ -134,6 +136,55 @@ void shouldRedirectWhenPushingBlob(WireMockRuntimeInfo wmRuntimeInfo) throws IOE
         registry.pushBlob(containerRef, testFile);
     }
 
+    @Test
+    void shouldNotSendAuthHeaderOnRedirectToDifferentDomain(WireMockRuntimeInfo wmRuntimeInfo) {
+        String digest = SupportedAlgorithm.SHA256.digest("blob-data".getBytes());
+
+        // Setup second WireMock instance on a different port
+        WireMockServer redirectTarget =
+                new WireMockServer(WireMockConfiguration.options().dynamicPort());
+        redirectTarget.start();
+
+        try {
+            String redirectUrl = "http://localhost:%d/v2/other/blobs/sha256:other".formatted(redirectTarget.port());
+
+            WireMock mainMock = wmRuntimeInfo.getWireMock();
+
+            // Main mock responds with redirect to different domain
+            mainMock.register(WireMock.any(WireMock.urlEqualTo("/v2/library/artifact/blobs/%s".formatted(digest)))
+                    .willReturn(WireMock.temporaryRedirect(redirectUrl)));
+
+            // Secondary server returns blob, we inspect headers here
+            redirectTarget.stubFor(WireMock.get(WireMock.urlEqualTo("/v2/other/blobs/sha256:other"))
+                    .willReturn(WireMock.ok()
+                            .withBody("blob-data")
+                            .withHeader(Const.DOCKER_CONTENT_DIGEST_HEADER, digest)));
+
+            redirectTarget.stubFor(WireMock.head(WireMock.urlEqualTo("/v2/other/blobs/sha256:other"))
+                    .willReturn(WireMock.ok()));
+
+            // Registry setup with auth that would inject an Authorization header
+            Registry registry = Registry.Builder.builder()
+                    .withAuthProvider(authProvider)
+                    .withInsecure(true)
+                    .build();
+
+            ContainerRef containerRef =
+                    ContainerRef.parse("localhost:%d/library/artifact".formatted(wmRuntimeInfo.getHttpPort()));
+            byte[] blob = registry.getBlob(containerRef.withDigest(digest));
+
+            assertEquals("blob-data", new String(blob));
+
+            // Assert Authorization header was not sent to the redirect target
+            redirectTarget.verify(
+                    1,
+                    WireMock.getRequestedFor(WireMock.urlEqualTo("/v2/other/blobs/sha256:other"))
+                            .withoutHeader("Authorization"));
+        } finally {
+            redirectTarget.stop();
+        }
+    }
+
     @Test
     void shouldListTags(WireMockRuntimeInfo wmRuntimeInfo) {