Package org.apache.juneau.rest.client

Class RedirectSecurity

java.lang.Object
org.apache.juneau.rest.client.RedirectSecurity
public final class RedirectSecurity extends Object
Pure decision logic for whether caller-set credential headers (such as Authorization or Cookie) should be forwarded or stripped when a REST call is transparently replayed against a redirect target (an HTTP 3xx response's Location).

This class contains only the decision — it does not itself intercept, follow, or rewrite any request. Each transport binding (classic, HttpClient-4.5/5.x, Jetty, OkHttp, the JDK client, etc.) is responsible for calling into this class from its own redirect hook and acting on the result.

The policy is intentionally simple and conservative:

  • Credentials are forwarded only when the redirect target is the exact same origin as the original request — same scheme, same host (case-insensitive), and same port (after applying the standard default port for http/https).
  • Credentials are stripped on any other origin change (different scheme, host, or port).
  • Credentials are stripped on an https → http scheme downgrade, even in the (impossible under the same-origin rule above) case that host and port otherwise match.

Both from and to must be absolute URIs (non-null scheme and host); callers are responsible for resolving a relative Location header against the original request URI before calling into this class.

Example:

if (RedirectSecurity.shouldStripCredentials(originalUri, redirectUri)) { // remove Authorization / Cookie / etc. before replaying the request }

Since:
10.0.0

  • Method Details

    • sameOrigin

      public static boolean sameOrigin(URI from, URI to)
      Returns true if from and to share the same origin — scheme, host (case-insensitive), and port (after default-port normalization for http/https).
      Parameters:
      from - The original request URI. Must be absolute (non-null scheme and host).
      to - The redirect target URI. Must be absolute (non-null scheme and host).
      Returns:
      true if both URIs resolve to the same origin.
      Throws:
      IllegalArgumentException - If either argument is null or not an absolute URI.

    • isDowngrade

      public static boolean isDowngrade(URI from, URI to)
      Returns true if the redirect represents an https → http scheme downgrade.
      Parameters:
      from - The original request URI. Must be absolute (non-null scheme and host).
      to - The redirect target URI. Must be absolute (non-null scheme and host).
      Returns:
      true if from is https and to is http.
      Throws:
      IllegalArgumentException - If either argument is null or not an absolute URI.

    • decide

      public static RedirectSecurity.CredentialDecision decide(URI from, URI to)
      Decides whether credentials should be forwarded or stripped for a single redirect hop.
      Parameters:
      from - The original request URI. Must be absolute (non-null scheme and host).
      to - The redirect target URI. Must be absolute (non-null scheme and host).
      Returns:
      RedirectSecurity.CredentialDecision.STRIP unless to is the exact same origin as from (and not a scheme downgrade), in which case RedirectSecurity.CredentialDecision.FORWARD.
      Throws:
      IllegalArgumentException - If either argument is null or not an absolute URI.

    • shouldStripCredentials

      public static boolean shouldStripCredentials(URI from, URI to)
      Convenience boolean form of decide(URI, URI).
      Parameters:
      from - The original request URI. Must be absolute (non-null scheme and host).
      to - The redirect target URI. Must be absolute (non-null scheme and host).
      Returns:
      true if credentials must be stripped before replaying the request against to.
      Throws:
      IllegalArgumentException - If either argument is null or not an absolute URI.

    • stripOnCrossOrigin

      public static Set<String> stripOnCrossOrigin()
      Returns the header names that must be stripped from a request before it is replayed cross-origin. Reuses the canonical credential-header set from RedactedHeaders.DEFAULT.
      Returns:
      The set of header names to strip on a cross-origin (or downgraded) redirect.