Compare the origin, not the host, and add a NEWS entry

The origin includes the scheme, so credentials are no longer sent if the
connection is downgraded from HTTPS to HTTP.

Author: serhiy-storchaka

Lib/test/test_urllib2.py

@@ -1429,9 +1429,7 @@ def request(conn, method, url, *pos, **kw):
         fp = urllib.request.urlopen("http://python.org/path")
         self.assertEqual(fp.geturl(), "http://python.org/path?query")
 
-    def test_redirect_to_cross_domain_with_sensitive_header(self):
-        from_url = "http://example.com/index.html"
-        to_url = "http://cracker.com/index.html"
+    def redirect_with_sensitive_headers(self, from_url, to_url):
         h = urllib.request.HTTPRedirectHandler()
         o = h.parent = MockOpener()
         req = Request(from_url)
@@ -1440,24 +1438,36 @@ def test_redirect_to_cross_domain_with_sensitive_header(self):
         req.timeout = socket._GLOBAL_DEFAULT_TIMEOUT
         h.http_error_302(req, MockFile(), 302, "",
             MockHeaders({"location": to_url}))
-
-        self.assertNotIn("Authorization", o.req.headers)
-        self.assertNotIn("Cookie", o.req.headers)
-
-    def test_redirect_to_same_domain_with_sensitive_header(self):
-        from_url = "http://example.com/index.html"
-        to_url = "http://example.com/index.html"
-        h = urllib.request.HTTPRedirectHandler()
-        o = h.parent = MockOpener()
-        req = Request(from_url)
-        req.add_header("Authorization", "Basic foo")
-        req.add_header("Cookie", "bar")
-        req.timeout = socket._GLOBAL_DEFAULT_TIMEOUT
-        h.http_error_302(req, MockFile(), 302, "",
-            MockHeaders({"location": to_url}))
-
-        self.assertIn("Authorization", o.req.headers)
-        self.assertIn("Cookie", o.req.headers)
+        return o.req.headers
+
+    def test_redirect_to_same_origin_with_sensitive_header(self):
+        for to_url in [
+            "http://example.com/index.html",
+            "http://example.com/other.html",
+        ]:
+            with self.subTest(to_url):
+                headers = self.redirect_with_sensitive_headers(
+                    "http://example.com/index.html", to_url)
+                self.assertIn("Authorization", headers)
+                self.assertIn("Cookie", headers)
+
+    def test_redirect_to_other_origin_with_sensitive_header(self):
+        # The origin includes the scheme, the host and the port, so
+        # credentials are not sent if any of them differs (gh-77842).
+        for from_url, to_url in [
+            # other host
+            ("http://example.com/index.html", "http://cracker.com/index.html"),
+            # other port
+            ("http://example.com/index.html", "http://example.com:8080/i.html"),
+            # downgrade from HTTPS to HTTP
+            ("https://example.com/index.html", "http://example.com/index.html"),
+            # upgrade from HTTP to HTTPS
+            ("http://example.com/index.html", "https://example.com/index.html"),
+        ]:
+            with self.subTest(from_url=from_url, to_url=to_url):
+                headers = self.redirect_with_sensitive_headers(from_url, to_url)
+                self.assertNotIn("Authorization", headers)
+                self.assertNotIn("Cookie", headers)
 
     def test_redirect_encoding(self):
         # Some characters in the redirect target may need special handling,

Lib/urllib/request.py

@@ -655,8 +655,11 @@ def redirect_request(self, req, fp, code, msg, headers, newurl):
                        origin_req_host=req.origin_req_host,
                        unverifiable=True)
 
+        # Do not send credentials to other origin.  The origin includes
+        # the scheme, so they are not sent if the connection is downgraded
+        # from HTTPS to HTTP either.
         SENSITIVE_HEADERS = ("authorization", "cookie")
-        if newrequest.host != req.host:
+        if (newrequest.type, newrequest.host) != (req.type, req.host):
             newrequest.headers = {k: v for k, v in newrequest.headers.items()
                                   if k.lower() not in SENSITIVE_HEADERS}
 

Misc/NEWS.d/next/Security/2026-08-12-08-30-00.gh-issue-77842.Kv3nQr.rst

@@ -0,0 +1,4 @@
+:class:`urllib.request.HTTPRedirectHandler` no longer sends the
+``Authorization`` and ``Cookie`` headers when it is redirected to other
+origin.  The origin includes the scheme, so they are no longer sent if the
+connection is downgraded from HTTPS to HTTP either.