\\n>

⚙️ Run configuration

\\n> \\n> **Configuration used**: defaults\\n> \\n> **Review profile**: CHILL\\n> \\n> **Plan**: Pro\\n> \\n> **Run ID**: `2739d02f-4442-4e48-9c3c-b5192cb9d48e`\\n> \\n>

\\n> \\n> You can disable this status message by setting the `reviews.review_status` to `false` in the CodeRabbit configuration file.\\n> \\n> Use the checkbox below for a quick retry:\\n> - [ ] 🔍 Trigger review\\n\\n\\n\\n\\n\\n

\\n

✨ Finishing Touches

\\n\\n

\\n

🧪 Generate unit tests (beta)

\\n\\n- [ ] Create PR with unit tests\\n- [ ] Commit unit tests in branch `fix/cross-origin-redirect-credential-leak-2.x`\\n\\n

\\n\\n

\\n\\n\\n\\n\\n---\\n\\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=node-modules/urllib&utm_content=813)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\\n\\n

\\n

❤️ Share

\\n\\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\\n\\n

\\n\\n\\n_{Comment `@coderabbitai help` to get the list of available commands and usage tips.}\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"![high](https://www.gstatic.com/codereviewagent/high-priority.svg)\\n\\n### Issue 1: Inconsistent Same-Origin Detection in Fallback Parser\\nIn the fallback path (when `URL` is not available, e.g., in older Node.js versions), comparing `from.host !== to.host` can incorrectly treat same-origin redirects as cross-origin if one URL explicitly includes the default port (e.g., `:80` for HTTP or `:443` for HTTPS) and the other does not. This is because `urlutil.parse` does not normalize default ports in the `host` property (unlike the modern `URL` API). This would cause sensitive headers to be stripped on legitimate same-origin redirects.\\n\\n### Issue 2: Unsafe Fail-Open on Parser Error\\nIf `isCrossOriginRedirect` throws an error during parsing, returning `false` in the `catch` block means the redirect is assumed to be same-origin, and credentials will be forwarded. To prevent potential credential leakage on malformed or unexpected redirect URLs, the fallback should fail-closed by returning `true` (treating it as cross-origin).\\n\\n### Suggestion\\nNormalize the ports in the fallback comparison and return `true` in the `catch` block to ensure a secure, fail-closed behavior.\\n\\n```javascript\\nfunction isCrossOriginRedirect(fromHref, toUrl) {\\n try {\\n if (URL) {\\n return new URL(fromHref).origin !== new URL(toUrl, fromHref).origin;\\n }\\n var from = urlutil.parse(fromHref);\\n var to = urlutil.parse(urlutil.resolve(fromHref, toUrl));\\n var fromPort = from.port || (from.protocol === 'https:' ? '443' : '80');\\n var toPort = to.port || (to.protocol === 'https:' ? '443' : '80');\\n return from.protocol !== to.protocol || from.hostname !== to.hostname || fromPort !== toPort;\\n } catch (err) {\\n return true;\\n }\\n}\\n```\",\"path\":\"lib/urllib.js\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"## Code Review\\n\\nThis pull request introduces security enhancements to prevent credential leakage by stripping sensitive headers (such as Authorization, Cookie, and Proxy-Authorization) and clearing authentication options during cross-origin redirects, while preserving them for same-origin redirects. Feedback on these changes highlights two critical issues in the fallback parser of `isCrossOriginRedirect`: first, comparing unnormalized hosts can cause same-origin redirects with explicit default ports to be incorrectly treated as cross-origin; second, the parser fails open by returning `false` on errors, which could leak credentials. It is recommended to normalize the ports and fail closed by returning `true` in the catch block.\\n\\n> [!IMPORTANT]\\n> The [consumer version of Gemini Code Assist on GitHub](https://developers.google.com/gemini-code-assist/docs/review-repo-code) is being sunset. Starting **June 18, 2026**, new organization installations will be blocked, and all code review activity will officially cease on **July 17, 2026**.\\n> For more details on the timeline and next steps, please review the [Help Documentation](https://developers.google.com/gemini-code-assist/docs/deprecations/consumer-code-review).\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"Thanks, both points addressed in the fallback parser (the `urlutil.parse` branch, only used when the WHATWG `URL` global is unavailable):\\n\\n1. **Default-port normalization**: now compares `protocol` + `hostname` + a normalized port (defaulting to 443/80) instead of the raw `host`, so same-origin redirects with an explicit `:80`/`:443` are no longer treated as cross-origin.\\n2. **Fail closed**: the `catch` now returns `true`, so if the origin can't be determined the credentials are stripped rather than forwarded.\\n\\nThe primary path uses `URL.origin`, which already normalizes default ports and throws on a malformed location before the strip runs, so it was unaffected; the change is limited to the fallback.\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"@codex review\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve credentials on same-origin object redirects**\\n\\nWhen the original request is made with an HTTP options-style object that does not include `href` (the function accepts object URLs and builds `options.host`/`options.path` from them), `parsedUrl.href` is `undefined`, so `isCrossOriginRedirect()` throws and returns `true`. That means even a relative redirect back to the same host strips `Authorization`/`Cookie` and clears `args.auth`, breaking authenticated same-origin redirects for this supported call form; build the origin from the parsed request fields/options instead of relying only on `parsedUrl.href`.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"lib/urllib.js\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve proxy auth when reusing the same proxy**\\n\\nFor proxied requests where the caller pins a proxy with `args.proxy`/`URLLIB_PROXY` and supplies `Proxy-Authorization` in the request headers, a redirect to another origin still goes through that same authenticated proxy, but this list removes the proxy credential before the recursive request. In that context the header authenticates the proxy rather than the redirected origin, so authenticated proxies can start returning 407 on any cross-origin redirect; only strip it when it is actually being sent as an origin header rather than while proxying.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"lib/urllib.js\",\"side\":\"RIGHT\",\"line\":71}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Avoid clearing caller auth options in place**\\n\\nWhen a caller reuses the same options object after a request that followed a cross-origin redirect, these assignments permanently replace their `auth`/`digestAuth` values with `null`. The next request with that options object no longer authenticates even if it is sent directly to the original origin; clone the redirect args before dropping credentials so redirect-specific sanitization does not corrupt the caller's reusable options.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"lib/urllib.js\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `1e81b9225c`\\n \\n\\n

ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"## [Codecov](https://app.codecov.io/gh/node-modules/urllib/pull/813?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) Report\\n:x: Patch coverage is `75.00000%` with `6 lines` in your changes missing coverage. Please review.\\n:white_check_mark: Project coverage is 91.09%. Comparing base ([`02cad0e`](https://app.codecov.io/gh/node-modules/urllib/commit/02cad0ecc16024a4182683bbccab701d30b59ad7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules)) to head ([`e967cbf`](https://app.codecov.io/gh/node-modules/urllib/commit/e967cbf17c375c590e6fb4e679975b7216c9453e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules)).\\n:warning: Report is 2 commits behind head on 2.x.\\n\\n| [Files with missing lines](https://app.codecov.io/gh/node-modules/urllib/pull/813?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) | Patch % | Lines |\\n|---|---|---|\\n| [lib/urllib.js](https://app.codecov.io/gh/node-modules/urllib/pull/813?src=pr&el=tree&filepath=lib%2Furllib.js&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules#diff-bGliL3VybGxpYi5qcw==) | 75.00% | [6 Missing :warning: ](https://app.codecov.io/gh/node-modules/urllib/pull/813?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) |\\n\\n

Additional details and impacted files

\\n\\n\\n\\n```diff\\n@@ Coverage Diff @@\\n## 2.x #813 +/- ##\\n==========================================\\n- Coverage 91.91% 91.09% -0.83% \\n==========================================\\n Files 6 6 \\n Lines 829 853 +24 \\n Branches 225 233 +8 \\n==========================================\\n+ Hits 762 777 +15 \\n- Misses 67 76 +9 \\n```\\n

\\n\\n[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/node-modules/urllib/pull/813?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules). \\n:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules).\\n

:rocket: New features to boost your workflow:

\\n\\n- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.\\n- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.\\n

\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_426":723,"_407":408,"_428":414},{"_429":724,"_431":-5,"_41":-5,"_432":-5,"_94":330,"_90":434},[725],{"_45":719,"_90":726},"input_text",{"_426":728,"_407":408,"_428":414},{"_429":729,"_431":-5,"_41":-5,"_432":-5,"_94":330,"_90":434},[730],{"_45":731,"_90":726},"\n /workspace/urllib\n bash\n 2026-06-13\n Etc/UTC\n",{"_426":733,"_407":408,"_428":414},{"_429":734,"_431":-5,"_41":-5,"_432":-5,"_94":735,"_90":434},[736,737],"developer",{"_45":739,"_90":726},{"_45":738,"_90":726},"\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; prioritize OpenAI docs MCP tools, use bundled references only as helper context, and restrict any fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_407":408,"_85":742},{"_101":-5,"_41":414,"_415":743,"_417":418,"_419":744},[],"inProgress",{"_419":746,"_407":408},{"_747":748,"_90":749},"activeFlags",[],"active","thread/started",{"_752":753},"thread",{"_754":-5,"_755":-5,"_756":757,"_758":418,"_470":471,"_759":15,"_760":-5,"_761":-5,"_41":408,"_762":763,"_191":-5,"_164":764,"_765":205,"_475":766,"_419":767,"_75":768,"_769":418},"agentNickname","agentRole","cliVersion","0.128.0","createdAt","ephemeral","forkedFromId","gitInfo","modelProvider","openai","/opt/codex/sessions/2026/06/13/rollout-2026-06-13T14-33-03-019ec166-89a1-7721-8603-431a8b004d07.jsonl","preview","vscode",{"_90":423},[],"updatedAt",[],"messages",[773],{"_41":774,"_775":776,"_777":778,"_779":778,"_429":780,"_419":781,"_431":-5,"_782":31,"_783":784,"_785":304,"_786":-5},"ab9e9b4f-9514-4b5e-a47b-ae4f264a7131","author",{"_94":330,"_191":-5,"_783":795},"create_time",1781361182.444803,"update_time",{"_791":45,"_792":793},"finished_successfully","weight","metadata",{"_787":788},"recipient","channel","l1239dk1",{"_789":790},"inline_comments",[],"content_type","parts",[794],"Thanks @chatgpt-codex-connector, all three addressed in 44c1935:\n\n1. **Don't clear caller auth in place** - the cross-origin branch now clones `args` (`Object.assign({}, args)`) and drops `auth`/`digestAuth`/credential headers on the clone, so reusing the same options object after a redirect still authenticates against the original origin. Added a regression test asserting `opts.auth`/`opts.headers` are untouched.\n\n2. **Preserve proxy auth when proxied** - when a proxy tunnel is in use (`proxyTunnelAgent`), `Proxy-Authorization` is kept (it authenticates the unchanged proxy hop, not the redirected origin), so pinned authenticated proxies no longer 407 on cross-origin redirects. It's still stripped when there's no proxy (where it would otherwise reach the target origin).\n\n3. **Same-origin object-URL redirects** - origin detection now derives an href from the parsed URL components (`host`/`hostname`/`port`/`path`) when the caller passes an options-style object without `href`, so same-origin redirects are detected correctly instead of hitting the fail-closed path and stripping credentials. (Truly-undeterminable origins still fail closed.)\n\nThe Gemini fallback-parser points (default-port normalization + fail-closed) from the earlier review are already in.\nfix: do not forward credential headers on cross-origin redirect\n\n## Problem\n\nWhen following a redirect to a different origin, urllib reused the caller's `args` verbatim, re-sending `Authorization`, `Cookie`, and `Proxy-Authorization` headers (and re-applying the Basic `auth` option) to the new origin. The only existing cleanup was the `Host` header.\n\n## Fix\n\nIn `handleRedirect`, when the redirect target origin differs from the current origin, strip those credential headers and clear `auth`/`digestAuth` before following. Same-origin redirects are unchanged; the caller's headers object is not mutated.\n\n## Tests\n\nNew `test/redirect-cross-origin.test.js` with two local servers on different ports: cross-origin strip (headers + `auth`) and same-origin preserve. Verified the cross-origin cases fail without the fix.\n\n\n\n> [!IMPORTANT]\n> ## Review skipped\n> \n> Auto reviews are disabled on base/target branches other than the default branch.\n> \n> \n> \n> Please check the settings in the CodeRabbit UI or the `.coderabbit.yaml` file in this repository. To trigger a single review, invoke the `@coderabbitai review` command.\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: defaults\n> \n> **Review profile**: CHILL\n> \n> **Plan**: Pro\n> \n> **Run ID**: `2739d02f-4442-4e48-9c3c-b5192cb9d48e`\n> \n>

\n> \n> You can disable this status message by setting the `reviews.review_status` to `false` in the CodeRabbit configuration file.\n> \n> Use the checkbox below for a quick retry:\n> - [ ] 🔍 Trigger review\n\n\n\n\n\n

✨ Finishing Touches

\n\n

🧪 Generate unit tests (beta)

\n\n- [ ] Create PR with unit tests\n- [ ] Commit unit tests in branch `fix/cross-origin-redirect-credential-leak-2.x`\n\n

\n\n

\n\n\n\n\n---\n\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=node-modules/urllib&utm_content=813)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\n\n

❤️ Share

\n\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\n\n

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands and usage tips.}\n\n\n![high](https://www.gstatic.com/codereviewagent/high-priority.svg)\n\n### Issue 1: Inconsistent Same-Origin Detection in Fallback Parser\nIn the fallback path (when `URL` is not available, e.g., in older Node.js versions), comparing `from.host !== to.host` can incorrectly treat same-origin redirects as cross-origin if one URL explicitly includes the default port (e.g., `:80` for HTTP or `:443` for HTTPS) and the other does not. This is because `urlutil.parse` does not normalize default ports in the `host` property (unlike the modern `URL` API). This would cause sensitive headers to be stripped on legitimate same-origin redirects.\n\n### Issue 2: Unsafe Fail-Open on Parser Error\nIf `isCrossOriginRedirect` throws an error during parsing, returning `false` in the `catch` block means the redirect is assumed to be same-origin, and credentials will be forwarded. To prevent potential credential leakage on malformed or unexpected redirect URLs, the fallback should fail-closed by returning `true` (treating it as cross-origin).\n\n### Suggestion\nNormalize the ports in the fallback comparison and return `true` in the `catch` block to ensure a secure, fail-closed behavior.\n\n```javascript\nfunction isCrossOriginRedirect(fromHref, toUrl) {\n try {\n if (URL) {\n return new URL(fromHref).origin !== new URL(toUrl, fromHref).origin;\n }\n var from = urlutil.parse(fromHref);\n var to = urlutil.parse(urlutil.resolve(fromHref, toUrl));\n var fromPort = from.port || (from.protocol === 'https:' ? '443' : '80');\n var toPort = to.port || (to.protocol === 'https:' ? '443' : '80');\n return from.protocol !== to.protocol || from.hostname !== to.hostname || fromPort !== toPort;\n } catch (err) {\n return true;\n }\n}\n```\n## Code Review\n\nThis pull request introduces security enhancements to prevent credential leakage by stripping sensitive headers (such as Authorization, Cookie, and Proxy-Authorization) and clearing authentication options during cross-origin redirects, while preserving them for same-origin redirects. Feedback on these changes highlights two critical issues in the fallback parser of `isCrossOriginRedirect`: first, comparing unnormalized hosts can cause same-origin redirects with explicit default ports to be incorrectly treated as cross-origin; second, the parser fails open by returning `false` on errors, which could leak credentials. It is recommended to normalize the ports and fail closed by returning `true` in the catch block.\n\n> [!IMPORTANT]\n> The [consumer version of Gemini Code Assist on GitHub](https://developers.google.com/gemini-code-assist/docs/review-repo-code) is being sunset. Starting **June 18, 2026**, new organization installations will be blocked, and all code review activity will officially cease on **July 17, 2026**.\n> For more details on the timeline and next steps, please review the [Help Documentation](https://developers.google.com/gemini-code-assist/docs/deprecations/consumer-code-review).\nThanks, both points addressed in the fallback parser (the `urlutil.parse` branch, only used when the WHATWG `URL` global is unavailable):\n\n1. **Default-port normalization**: now compares `protocol` + `hostname` + a normalized port (defaulting to 443/80) instead of the raw `host`, so same-origin redirects with an explicit `:80`/`:443` are no longer treated as cross-origin.\n2. **Fail closed**: the `catch` now returns `true`, so if the origin can't be determined the credentials are stripped rather than forwarded.\n\nThe primary path uses `URL.origin`, which already normalizes default ports and throws on a malformed location before the strip runs, so it was unaffected; the change is limited to the fallback.\n@codex review\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve credentials on same-origin object redirects**\n\nWhen the original request is made with an HTTP options-style object that does not include `href` (the function accepts object URLs and builds `options.host`/`options.path` from them), `parsedUrl.href` is `undefined`, so `isCrossOriginRedirect()` throws and returns `true`. That means even a relative redirect back to the same host strips `Authorization`/`Cookie` and clears `args.auth`, breaking authenticated same-origin redirects for this supported call form; build the origin from the parsed request fields/options instead of relying only on `parsedUrl.href`.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve proxy auth when reusing the same proxy**\n\nFor proxied requests where the caller pins a proxy with `args.proxy`/`URLLIB_PROXY` and supplies `Proxy-Authorization` in the request headers, a redirect to another origin still goes through that same authenticated proxy, but this list removes the proxy credential before the recursive request. In that context the header authenticates the proxy rather than the redirected origin, so authenticated proxies can start returning 407 on any cross-origin redirect; only strip it when it is actually being sent as an origin header rather than while proxying.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Avoid clearing caller auth options in place**\n\nWhen a caller reuses the same options object after a request that followed a cross-origin redirect, these assignments permanently replace their `auth`/`digestAuth` values with `null`. The next request with that options object no longer authenticates even if it is sent directly to the original origin; clone the redirect args before dropping credentials so redirect-specific sanitization does not corrupt the caller's reusable options.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `1e81b9225c`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

\n## [Codecov](https://app.codecov.io/gh/node-modules/urllib/pull/813?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) Report\n:x: Patch coverage is `75.00000%` with `6 lines` in your changes missing coverage. Please review.\n:white_check_mark: Project coverage is 91.09%. Comparing base ([`02cad0e`](https://app.codecov.io/gh/node-modules/urllib/commit/02cad0ecc16024a4182683bbccab701d30b59ad7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules)) to head ([`e967cbf`](https://app.codecov.io/gh/node-modules/urllib/commit/e967cbf17c375c590e6fb4e679975b7216c9453e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules)).\n:warning: Report is 2 commits behind head on 2.x.\n\n| [Files with missing lines](https://app.codecov.io/gh/node-modules/urllib/pull/813?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) | Patch % | Lines |\n|---|---|---|\n| [lib/urllib.js](https://app.codecov.io/gh/node-modules/urllib/pull/813?src=pr&el=tree&filepath=lib%2Furllib.js&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules#diff-bGliL3VybGxpYi5qcw==) | 75.00% | [6 Missing :warning: ](https://app.codecov.io/gh/node-modules/urllib/pull/813?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) |\n\n

Additional details and impacted files

\n\n\n\n```diff\n@@ Coverage Diff @@\n## 2.x #813 +/- ##\n==========================================\n- Coverage 91.91% 91.09% -0.83% \n==========================================\n Files 6 6 \n Lines 829 853 +24 \n Branches 225 233 +8 \n==========================================\n+ Hits 762 777 +15 \n- Misses 67 76 +9 \n```\n

\n\n[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/node-modules/urllib/pull/813?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules). \n:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules).\n

:rocket: New features to boost your workflow:

\n\n- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.\n- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.\n

",{},"created",1781361250.077323,"Completing the task","event_type","info",{"_90":434,"_94":91,"_429":1879},{"_90":803,"_804":805},"partial_repo_snapshot","files",[806,807],{"_164":903,"_809":-5,"_810":904,"_812":-5},{"_164":808,"_809":-5,"_810":811,"_812":-5},"test/redirect-cross-origin.test.js","contents","line_range_contents",[813],"missing_reason",{"_814":815,"_816":817,"_429":818,"_819":57},"line_range_start",1,"line_range_end",138,[820,205,821,822,823,205,824,825,826,827,828,829,830,831,205,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,842,847,848,845,849,850,851,852,853,854,855,852,837,856,205,857,858,859,860,861,862,860,856,205,863,864,865,866,867,868,869,205,870,871,872,873,874,875,876,877,878,879,880,881,882,837,856,205,883,884,872,873,874,875,876,877,878,885,886,887,882,837,856,205,888,871,872,889,874,875,876,878,879,882,837,856,205,890,884,872,889,874,875,876,878,891,882,837,856,205,892,893,894,895,875,876,896,878,879,897,898,899,900,901,882,837,856,902],"contains_end_of_file","'use strict';","var assert = require('assert');","var http = require('http');","var urllib = require('../');","// On a cross-origin redirect, credential-bearing request headers","// (Authorization, Cookie, Proxy-Authorization) and the `auth` option must NOT","// be forwarded to the new origin. Same-origin redirects should keep them.","describe('test/redirect-cross-origin.test.js', function() {"," var serverA;"," var serverB;"," var portA;"," var portB;"," before(function(done) {"," serverB = http.createServer(function(req, res) {"," res.statusCode = 200;"," res.setHeader('Content-Type', 'application/json');"," res.end(JSON.stringify(req.headers));"," });"," serverB.listen(0, function() {"," portB = serverB.address().port;"," serverA = http.createServer(function(req, res) {"," if (req.url === '/start-cross') {"," res.statusCode = 302;"," res.setHeader('Location', 'http://127.0.0.1:' + portB + '/captured');"," return res.end('redirect to B');"," }"," if (req.url === '/start-same') {"," res.setHeader('Location', '/captured');"," return res.end('redirect to self');"," res.statusCode = 200;"," res.setHeader('Content-Type', 'application/json');"," res.end(JSON.stringify(req.headers));"," });"," serverA.listen(0, function() {"," portA = serverA.address().port;"," done();"," });"," after(function() {"," if (serverA) {"," serverA.close();"," }"," if (serverB) {"," serverB.close();"," function credentialHeaders() {"," return {"," Authorization: 'Bearer LIVE-AUTH',"," Cookie: 'session=LIVE-COOKIE',"," 'Proxy-Authorization': 'Bearer proxy-LIVE',"," };"," }"," it('should NOT forward credential headers on cross-origin redirect', function(done) {"," urllib.request('http://127.0.0.1:' + portA + '/start-cross', {"," followRedirect: true,"," headers: credentialHeaders(),"," }, function(err, data, res) {"," assert(!err);"," assert.equal(res.statusCode, 200);"," assert.equal(res.requestUrls.length, 2);"," var received = JSON.parse(data.toString());"," assert.equal(received.authorization, undefined);"," assert.equal(received.cookie, undefined);"," assert.equal(received['proxy-authorization'], undefined);"," done();"," it('should keep credential headers on same-origin redirect', function(done) {"," urllib.request('http://127.0.0.1:' + portA + '/start-same', {"," assert.equal(received.authorization, 'Bearer LIVE-AUTH');"," assert.equal(received.cookie, 'session=LIVE-COOKIE');"," assert.equal(received['proxy-authorization'], 'Bearer proxy-LIVE');"," it('should NOT re-inject Basic auth (options.auth) on cross-origin redirect', function(done) {"," auth: 'user:passwd',"," it('should keep Basic auth (options.auth) on same-origin redirect', function(done) {"," assert.equal(received.authorization, 'Basic ' + Buffer.from('user:passwd').toString('base64'));"," it('should not mutate the caller options object on cross-origin redirect', function(done) {"," var headers = credentialHeaders();"," var opts = { followRedirect: true, auth: 'user:passwd', digestAuth: 'user:passwd', headers: headers };"," urllib.request('http://127.0.0.1:' + portA + '/start-cross', opts, function(err, data, res) {"," // credentials were stripped on the wire"," // but the caller's reusable options object is untouched"," assert.equal(opts.auth, 'user:passwd');"," assert.equal(opts.digestAuth, 'user:passwd');"," assert.equal(opts.headers, headers);"," assert.equal(opts.headers.Authorization, 'Bearer LIVE-AUTH');","});","lib/urllib.js",[905],{"_814":815,"_816":906,"_429":907,"_819":57},1400,[820,205,908,909,910,911,822,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,205,929,930,205,931,205,932,933,205,934,935,936,205,937,938,205,939,205,940,941,942,943,944,205,945,946,205,947,948,949,950,205,940,951,952,953,944,954,955,956,957,205,958,205,959,960,961,205,962,963,964,965,966,967,869,968,969,970,869,971,972,973,869,974,975,869,976,977,205,978,979,980,981,982,983,860,984,985,860,986,987,988,989,990,991,992,993,994,995,996,997,869,977,205,998,999,1000,1001,1002,1003,1004,1005,1006,1007,860,869,1008,977,205,1009,1010,205,1011,1012,205,940,1013,1014,1015,1014,1016,1017,1018,1019,1020,1021,1022,1014,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1058,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,944,1080,1081,1082,1083,1084,869,1085,1086,869,205,1087,1088,1089,869,1090,1091,856,1092,205,1093,1094,205,1095,1096,1097,1098,860,1099,1100,1101,1102,1103,837,1104,977,205,1105,1106,1107,1108,1109,1110,1007,1111,1112,1113,1114,1115,852,837,1104,1092,205,1116,1117,1118,1119,1120,1121,869,205,1082,1083,1084,869,205,1122,1123,1124,869,1125,205,1126,205,1127,1128,1129,1130,1131,205,1132,1133,1134,1135,860,984,1136,1137,1138,860,1139,1140,869,205,1141,1142,1143,1144,1145,1104,1146,1147,869,205,1148,1149,1150,1151,1152,205,1153,1154,1155,205,1156,1157,860,869,205,1158,1159,1160,1161,869,205,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,845,1175,852,868,869,205,1176,1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1104,205,1189,1190,1191,1192,1003,1004,1193,1194,1195,1007,1196,860,869,1197,1198,869,205,1199,1200,1201,1202,1203,1204,1205,1206,1207,1208,1209,1210,1211,1212,1213,860,869,205,1214,1215,1216,1217,860,869,205,1218,1219,1220,869,205,1221,1222,205,1223,1224,1225,860,1226,1227,1228,1229,1230,1231,1007,1137,1232,1233,1234,1235,1236,845,1007,860,1237,1238,1239,1240,1241,1007,860,205,1242,1243,1244,1245,1246,1247,1248,1249,1250,1251,1007,860,205,1252,1253,1254,1255,1256,860,1257,1258,1139,1259,1260,1261,1262,1263,1264,1265,1266,1267,1268,1269,1270,1271,1272,1273,1274,1275,1276,205,1277,1278,1279,1280,1281,1276,845,1007,860,869,205,1282,1283,1284,1285,1286,860,205,1287,1288,1289,1290,1007,1291,205,1292,860,869,205,1293,1294,1295,860,869,205,1296,1297,1298,869,205,1299,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1322,1323,1324,1325,868,869,205,1326,1327,1328,1329,1330,860,869,1331,1332,1333,1334,1335,860,869,205,1336,1337,1338,1339,1340,1341,1342,1109,1343,1344,1007,1345,860,205,1346,1347,1348,1349,1350,1351,1352,860,205,1353,1345,860,205,1354,205,1355,1356,1357,205,1097,1358,1359,1360,1361,1007,1362,1363,1364,1365,1366,1367,1368,1369,1370,1371,1372,860,205,1373,1374,1375,1376,1377,1378,1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1272,1392,1274,1276,845,1007,860,205,1393,205,1394,869,205,1395,1354,1396,869,205,1397,1398,1399,1400,860,205,1401,1402,1403,205,864,1404,1405,1406,1407,1408,1409,1410,1411,1100,1412,1413,1414,1415,1416,1417,868,869,205,1418,1419,1420,1421,1422,1423,1424,205,1425,1426,1427,1428,1429,1430,852,860,869,205,1431,1348,1432,1352,860,1433,1434,1435,1436,1437,1438,1439,1440,1441,1442,845,1443,1444,1445,1007,860,1446,869,205,1447,1448,1449,1450,1451,1452,1453,1454,1455,1456,1457,1250,1458,1459,1460,1461,1462,1463,1464,1465,845,1466,1467,1468,1469,1470,1471,1472,1473,1474,1475,1476,1477,1276,1478,1479,1480,1481,845,1482,1483,1484,1485,1486,1487,1488,1489,1007,860,864,1490,1491,868,869,205,1492,1493,1494,1495,860,1139,1496,1497,1498,1499,860,869,205,1500,1501,1502,1503,1504,1505,1007,860,869,205,1506,1507,1508,1509,1510,1511,1512,860,1513,1514,1515,860,205,1516,1517,1518,1519,1520,1521,1522,1523,1276,1524,1525,1526,1527,1528,860,869,205,1529,1530,205,1531,1532,205,1533,205,1534,1535,1536,1537,1538,1399,1539,860,1540,1541,205,1542,1543,1544,1545,1546,1547,1007,1548,1545,1549,1007,205,1550,860,205,1551,1552,1553,1554,837,205,1555,1556,1557,1558,837,205,1559,1560,1561,1562,1563,1564,1565,1566,1567,1563,1568,1569,1563,1570,1571,1572,1573,1543,1544,1545,1546,1547,1007,1548,1545,1574,1575,1576,1547,1007,205,1577,1578,1579,1580,1581,1582,1276,1583,1584,1525,1547,1007,205,1585,1586,1587,1588,1589,1590,1591,1592,1525,1593,1547,1007,205,1594,1595,1596,1597,1598,1599,845,1600,1601,852,1345,860,205,1602,1603,1604,1605,1606,1607,1603,1608,1609,1603,1610,1611,205,1612,205,1613,1614,1615,1616,837,205,1617,1618,1619,1620,1621,1547,1007,1622,205,1623,1624,1625,205,1626,1627,1628,1007,205,1543,1548,1629,1007,1544,1546,1547,1007,205,1630,1631,1632,845,1633,1634,1635,1636,1637,1638,1639,1640,1641,1276,205,1642,1643,1644,1272,1645,1646,1647,1648,1649,1650,1274,1276,845,205,1651,852,860,205,1652,1653,1654,837,1655,1656,837,869,205,1657,1658,1659,1660,1661,1662,869,1663,205,1664,1665,1666,1329,1667,1668,1007,1669,1670,1671,1672,1673,1007,1674,1675,1676,1677,1678,1679,869,205,1680,1681,1682,1334,1683,1684,1674,1675,1676,1685,1678,1686,869,205,1164,1687,1688,1689,1690,1691,1692,1693,860,1694,1695,1696,1697,1698,1699,1700,1701,1007,860,869,205,1702,979,1703,205,1704,1705,1706,1707,1708,1709,1710,1711,1712,845,205,1713,1714,1007,860,205,1715,1716,1717,1718,860,994,1719,869,205,1720,1721,1722,1723,869,205,1724,1725,1726,1345,860,1727,205,1728,1729,1730,1731,1732,860,1733,869,205,1734,1735,1736,1737,837,869,205,1738,1399,1739,1740,860,205,1741,1742,1743,1744,1745,860,205,1746,1747,1748,1749,1750,1751,1752,860,205,1753,1754,1755,860,205,1756,1757,1758,1759,1760,1761,845,1762,1763,845,852,1764,1760,1765,1766,845,205,1767,1768,1769,205,1770,1771,1772,1773,845,1774,852,1345,860,205,1775,1776,1777,1778,1779,860,1780,205,1781,1337,1782,856,205,1783,1784,1785,1786,1787,1678,837,869,205,1788,1789,1790,1345,860,1791,1792,1793,1345,860,1794,205,1795,1796,860,1797,1798,869,1799,1800,1801,1139,1802,1803,837,869,1804,1805,1806,1807,1808,1809,977,205,1810,205,1811,1812,1813,1814,1815,1816,1817,1818,1092,1819,205,1820,1821,977,205,1822,1823,977,205,1824,1825,1826,1827,1104,1828,1829,1830,1137,1831,1832,1833,860,869,979,1834,994,1835,1836,860,1837,1838,1839,1840,1137,1841,860,1842,869,1843,977,205,205,940,1844,1845,1846,1847,944,1848,1849,1850,1851,869,205,1852,1853,205,1854,1855,1856,860,1857,869,205,1858,977,205,1859,1860,977,205,1861,979,1862,994,1863,1864,869,977,205,1865,1866,1867,869,1868,1869,1867,869,1870,1867,869,1871,1872,1873,1874,869,977,205,1875,1876,1877,1878,977],"var debug = require('util').debuglog('urllib');","var path = require('path');","var dns = require('dns');","var net = require('net');","var https = require('https');","var urlutil = require('url');","var URL = urlutil.URL;","var util = require('util');","var qs = require('qs');","var querystring = require('querystring');","var zlib = require('zlib');","var ua = require('default-user-agent');","var digestAuthHeader = require('digest-header');","var ms = require('humanize-ms');","var statuses = require('statuses');","var contentTypeParser = require('content-type');","var first = require('ee-first');","var pump = require('pump');","var utility = require('utility');","var FormStream = require('formstream');","var detectProxyAgent = require('./detect_proxy_agent');","var _Promise;","var _iconv;","var pkg = require('../package.json');","var USER_AGENT = exports.USER_AGENT = ua('node-urllib', pkg.version);","var NODE_MAJOR_VERSION = parseInt(process.versions.node.split('.')[0]);","// change Agent.maxSockets to 1000","exports.agent = new http.Agent();","exports.agent.maxSockets = 1000;","exports.httpsAgent = new https.Agent();","exports.httpsAgent.maxSockets = 1000;","var LONG_STACK_DELIMITER = '\\n --------------------\\n';","/**"," * The default request timeout(in milliseconds)."," * @type {Number}"," * @const"," */","exports.TIMEOUT = ms('5s');","exports.TIMEOUTS = [ms('5s'), ms('5s')];","var REQUEST_ID = 0;","var MAX_VALUE = Math.pow(2, 31) - 10;","var isNode010 = /^v0\\.10\\.\\d+$/.test(process.version);","var isNode012 = /^v0\\.12\\.\\d+$/.test(process.version);"," * support data types"," * will auto decode response body"," * @type {Array}","var TEXT_DATA_TYPES = ["," 'json',"," 'text'","];","var PROTO_RE = /^https?:\\/\\//i;","// Credential-bearing headers that must not be forwarded across an origin","// boundary when following a redirect, to avoid leaking them to a third party.","var CROSS_ORIGIN_SENSITIVE_HEADERS = [ 'authorization', 'cookie', 'proxy-authorization' ];","// Build an absolute href good enough to compute the origin. `currentUrl` may be","// a parsed URL object (with href) or an http options-style object built from","// { host/hostname, port, path }, which has no href.","function resolveOriginHref(currentUrl) {"," if (currentUrl.href) {"," return currentUrl.href;"," var host = currentUrl.host || currentUrl.hostname;"," if (!host) {"," return null;"," var protocol = currentUrl.protocol || 'http:';"," if (protocol.charAt(protocol.length - 1) !== ':') {"," protocol += ':';"," if (currentUrl.port && String(host).indexOf(':') === -1) {"," host += ':' + currentUrl.port;"," return protocol + '//' + host + (currentUrl.path || currentUrl.pathname || '/');","}","function isCrossOriginRedirect(currentUrl, toUrl) {"," try {"," var fromHref = resolveOriginHref(currentUrl);"," if (!fromHref) {"," // origin cannot be determined: fail closed"," return true;"," if (URL) {"," return new URL(fromHref).origin !== new URL(toUrl, fromHref).origin;"," // Fallback for runtimes without the WHATWG URL global."," // urlutil.parse does not normalize default ports, so compare protocol +"," // hostname + normalized port instead of the raw `host`."," var from = urlutil.parse(fromHref);"," var to = urlutil.parse(urlutil.resolve(fromHref, toUrl));"," var fromPort = from.port || (from.protocol === 'https:' ? '443' : '80');"," var toPort = to.port || (to.protocol === 'https:' ? '443' : '80');"," return from.protocol !== to.protocol || from.hostname !== to.hostname || fromPort !== toPort;"," } catch (err) {"," // Fail closed: if the origin cannot be determined, treat it as cross-origin"," // so credentials are stripped rather than leaked."," return true;","function cleanCrossOriginHeaders(headers, sensitive) {"," var list = sensitive || CROSS_ORIGIN_SENSITIVE_HEADERS;"," var cleaned = {};"," if (headers) {"," var names = utility.getOwnEnumerables(headers, true);"," for (var i = 0; i < names.length; i++) {"," var name = names[i];"," if (list.indexOf(name.toLowerCase()) === -1) {"," cleaned[name] = headers[name];"," }"," return cleaned;","// Keep-Alive: timeout=5, max=100","var KEEP_ALIVE_RE = /^timeout=(\\d+)/i;","var SOCKET_REQUEST_COUNT = '_URLLIB_SOCKET_REQUEST_COUNT';","var SOCKET_RESPONSE_COUNT = '_URLLIB_SOCKET_RESPONSE_COUNT';"," * Handle all http request, both http and https support well."," *"," * @example"," * ```js"," * // GET https://nodejs.org"," * urllib.request('https://nodejs.org', function(err, data, res) {});"," * // POST https://nodejs.org"," * var args = { type: 'post', data: { foo: 'bar' } };"," * urllib.request('https://nodejs.org', args, function(err, data, res) {});"," * ```"," * @param {String|Object} url: the request full URL."," * @param {Object} [args]: optional"," * - {Object} [data]: request data, will auto be query stringify."," * - {Boolean} [dataAsQueryString]: force convert `data` to query string."," * - {String|Buffer} [content]: optional, if set content, `data` will ignore."," * - {ReadStream} [stream]: read stream to sent."," * - {WriteStream} [writeStream]: writable stream to save response data."," * If you use this, callback's data should be null."," * We will just `pipe(ws, {end: true})`."," * - {consumeWriteStream} [true]: consume the writeStream, invoke the callback after writeStream close."," * - {Array|Object|ReadStream|Buffer|String} [files]: optional,"," * The files will send with `multipart/form-data` format, base on `formstream`."," * If `method` not set, will use `POST` method by default."," * - {String} [method]: optional, could be GET | POST | DELETE | PUT, default is GET"," * - {String} [contentType]: optional, request data type, could be `json`, default is undefined"," * - {String} [dataType]: optional, response data type, could be `text` or `json`, default is buffer"," * - {Boolean|Function} [fixJSONCtlChars]: optional, fix the control characters (U+0000 through U+001F)"," * before JSON parse response. Default is `false`."," * `fixJSONCtlChars` can be a function, will pass data to the first argument. e.g.: `data = fixJSONCtlChars(data)`"," * - {Object} [headers]: optional, request headers"," * - {Boolean} [keepHeaderCase]: optional, by default will convert header keys to lowercase"," * - {Number|Array} [timeout]: request timeout(in milliseconds), default is `exports.TIMEOUTS containing connect timeout and response timeout`"," * - {Agent} [agent]: optional, http agent. Set `false` if you does not use agent."," * - {Agent} [httpsAgent]: optional, https agent. Set `false` if you does not use agent."," * - {String} [auth]: Basic authentication i.e. 'user:password' to compute an Authorization header."," * - {String} [digestAuth]: Digest authentication i.e. 'user:password' to compute an Authorization header."," * - {String|Buffer|Array} [ca]: An array of strings or Buffers of trusted certificates."," * If this is omitted several well known \"root\" CAs will be used, like VeriSign."," * These are used to authorize connections."," * Notes: This is necessary only if the server uses the self-signed certificate"," * - {Boolean} [rejectUnauthorized]: If true, the server certificate is verified against the list of supplied CAs."," * An 'error' event is emitted if verification fails. Default: true."," * - {String|Buffer} [pfx]: A string or Buffer containing the private key,"," * certificate and CA certs of the server in PFX or PKCS12 format."," * - {String|Buffer} [key]: A string or Buffer containing the private key of the client in PEM format."," * Notes: This is necessary only if using the client certificate authentication"," * - {String|Buffer} [cert]: A string or Buffer containing the certificate key of the client in PEM format."," * - {String} [passphrase]: A string of passphrase for the private key or pfx."," * - {String} [ciphers]: A string describing the ciphers to use or exclude."," * - {String} [secureProtocol]: The SSL method to use, e.g. SSLv3_method to force SSL version 3."," * The possible values depend on your installation of OpenSSL and are defined in the constant SSL_METHODS."," * - {Boolean} [followRedirect]: Follow HTTP 3xx responses as redirects. defaults to false."," * - {Number} [maxRedirects]: The maximum number of redirects to follow, defaults to 10."," * - {Function(from, to)} [formatRedirectUrl]: Format the redirect url by your self. Default is `url.resolve(from, to)`"," * - {Function(options)} [beforeRequest]: Before request hook, you can change every thing here."," * - {Boolean} [streaming]: let you get the res object when request connected, default is `false`. alias `customResponse`"," * - {Boolean} [gzip]: Accept gzip response content and auto decode it, default is `false`."," * - {Boolean} [timing]: Enable timing or not, default is `false`."," * - {Function} [lookup]: Custom DNS lookup function, default is `dns.lookup`."," * Require node >= 4.0.0 and only work on `http` protocol."," * - {Boolean} [enableProxy]: optional, enable proxy request. Default is `false`."," * - {String|Object} [proxy]: optional proxy agent uri or options. Default is `null`."," * - {String} [socketPath]: optional, unix domain socket file path."," * - {Function} checkAddress: optional, check request address to protect from SSRF and similar attacks."," * @param {Function} [callback]: callback(error, data, res). If missing callback, will return a promise object."," * @return {HttpRequest} req object."," * @api public","exports.request = function request(url, args, callback) {"," // request(url, callback)"," if (arguments.length === 2 && typeof args === 'function') {"," callback = args;"," args = null;"," if (typeof callback === 'function') {"," return exports.requestWithCallback(url, args, callback);"," // Promise"," if (!_Promise) {"," _Promise = require('any-promise');"," return new _Promise(function (resolve, reject) {"," exports.requestWithCallback(url, args, makeCallback(resolve, reject));","};","// alias to curl","exports.curl = exports.request;","function makeCallback(resolve, reject) {"," return function (err, data, res) {"," if (err) {"," return reject(err);"," resolve({"," data: data,"," status: res.statusCode,"," headers: res.headers,"," res: res"," };","// yield urllib.requestThunk(url, args)","exports.requestThunk = function requestThunk(url, args) {"," return function (callback) {"," exports.requestWithCallback(url, args, function (err, data, res) {"," if (err) {"," return callback(err);"," callback(null, {"," data: data,"," status: res.statusCode,"," headers: res.headers,"," res: res","function requestWithCallback(url, args, callback) {"," var req;"," // requestWithCallback(url, callback)"," if (!url || (typeof url !== 'string' && typeof url !== 'object')) {"," var msg = util.format('expect request url to be a string or a http request options, but got %j', url);"," throw new Error(msg);"," args = args || {};"," if (REQUEST_ID >= MAX_VALUE) {"," REQUEST_ID = 0;"," var reqId = ++REQUEST_ID;"," args.requestUrls = args.requestUrls || [];"," args.timeout = args.timeout || exports.TIMEOUTS;"," args.maxRedirects = args.maxRedirects || 10;"," args.streaming = args.streaming || args.customResponse;"," var requestStartTime = Date.now();"," var parsedUrl;"," if (typeof url === 'string') {"," if (!PROTO_RE.test(url)) {"," // Support `request('www.server.com')`"," url = 'http://' + url;"," parsedUrl = urlutil.parse(new URL(url).href);"," } else {"," parsedUrl = urlutil.parse(url);"," } else {"," parsedUrl = url;"," var reqMeta = {"," requestId: reqId,"," url: parsedUrl.href,"," args: args,"," ctx: args.ctx,"," if (args.emitter) {"," args.emitter.emit('request', reqMeta);"," var method = (args.type || args.method || parsedUrl.method || 'GET').toUpperCase();"," var port = parsedUrl.port || 80;"," var httplib = http;"," var agent = getAgent(args.agent, exports.agent);"," var fixJSONCtlChars = args.fixJSONCtlChars;"," if (parsedUrl.protocol === 'https:') {"," httplib = https;"," agent = getAgent(args.httpsAgent, exports.httpsAgent);"," if (!parsedUrl.port) {"," port = 443;"," // request through proxy tunnel"," var proxyTunnelAgent = detectProxyAgent(parsedUrl, args);"," if (proxyTunnelAgent) {"," agent = proxyTunnelAgent;"," var lookup = args.lookup;"," // check address to protect from SSRF and similar attacks"," if (args.checkAddress) {"," var _lookup = lookup || dns.lookup;"," lookup = function(host, dnsopts, callback) {"," _lookup(host, dnsopts, function emitLookup(err, ip, family) {"," // add check address logic in custom dns lookup"," if (!err && !args.checkAddress(ip, family, host)) {"," err = new Error('illegal address');"," err.name = 'IllegalAddressError';"," err.hostname = host;"," err.ip = ip;"," err.family = family;"," callback(err, ip, family);"," var requestSize = 0;"," var options = {"," host: parsedUrl.hostname || parsedUrl.host || 'localhost',"," path: parsedUrl.path || '/',"," method: method,"," port: port,"," agent: agent,"," headers: {},"," // default is dns.lookup"," // https://github.com/nodejs/node/blob/master/lib/net.js#L986"," // custom dnslookup require node >= 4.0.0 (for http), node >=8 (for https)"," // https://github.com/nodejs/node/blob/archived-io.js-v0.12/lib/net.js#L952"," lookup: lookup,"," var originHeaderKeys = {};"," if (args.headers) {"," // only allow enumerable and ownProperty value of args.headers"," var names = utility.getOwnEnumerables(args.headers, true);"," var key = name.toLowerCase();"," if (key !== name) {"," originHeaderKeys[key] = name;"," options.headers[key] = args.headers[name];"," if (args.socketPath) {"," options.socketPath = args.socketPath;"," var sslNames = ["," 'pfx',"," 'key',"," 'passphrase',"," 'cert',"," 'ca',"," 'ciphers',"," 'rejectUnauthorized',"," 'secureProtocol',"," 'secureOptions',"," ];"," for (var i = 0; i < sslNames.length; i++) {"," var name = sslNames[i];"," if (args.hasOwnProperty(name)) {"," options[name] = args[name];"," // fix rejectUnauthorized when major version < 12"," if (NODE_MAJOR_VERSION < 12) {"," if (options.rejectUnauthorized === false && !options.hasOwnProperty('secureOptions')) {"," options.secureOptions = require('constants').SSL_OP_NO_TLSv1_2;"," var auth = args.auth || parsedUrl.auth;"," if (auth) {"," options.auth = auth;"," var body = null;"," var dataAsQueryString = false;"," if (args.files) {"," if (!options.method || options.method === 'GET' || options.method === 'HEAD') {"," options.method = 'POST';"," var files = args.files;"," var uploadFiles = [];"," if (Array.isArray(files)) {"," for (var i = 0; i < files.length; i++) {"," var field = 'file' + (i === 0 ? '' : i);"," uploadFiles.push([ field, files[i] ]);"," if (Buffer.isBuffer(files) || typeof files.pipe === 'function' || typeof files === 'string') {"," uploadFiles.push([ 'file', files ]);"," } else if (typeof files === 'object') {"," for (var field in files) {"," uploadFiles.push([ field, files[field] ]);"," var form = new FormStream();"," // set normal fields first"," if (args.data) {"," for (var fieldName in args.data) {"," form.field(fieldName, args.data[fieldName]);"," for (var i = 0; i < uploadFiles.length; i++) {"," var item = uploadFiles[i];"," if (Buffer.isBuffer(item[1])) {"," form.buffer(item[0], item[1], 'bufferfile' + i);"," } else if (typeof item[1].pipe === 'function') {"," var filename = item[1].path || ('streamfile' + i);"," filename = path.basename(filename);"," form.stream(item[0], item[1], filename);"," } else {"," form.file(item[0], item[1]);"," var formHeaders = form.headers();"," var formHeaderNames = utility.getOwnEnumerables(formHeaders, true);"," for (var i = 0; i < formHeaderNames.length; i++) {"," var name = formHeaderNames[i];"," options.headers[name.toLowerCase()] = formHeaders[name];"," debug('set multipart headers: %j, method: %s', formHeaders, options.method);"," args.stream = form;"," body = args.content || args.data;"," dataAsQueryString = method === 'GET' || method === 'HEAD' || args.dataAsQueryString;"," if (!args.content) {"," if (body && !(typeof body === 'string' || Buffer.isBuffer(body))) {"," if (dataAsQueryString) {"," // read: GET, HEAD, use query string"," body = args.nestedQuerystring ? qs.stringify(body) : querystring.stringify(body);"," } else {"," var contentType = options.headers['content-type'];"," // auto add application/x-www-form-urlencoded when using urlencode form request"," if (!contentType) {"," if (args.contentType === 'json') {"," contentType = 'application/json';"," } else {"," contentType = 'application/x-www-form-urlencoded';"," }"," options.headers['content-type'] = contentType;"," }"," if (parseContentType(contentType).type === 'application/json') {"," body = JSON.stringify(body);"," } else {"," // 'application/x-www-form-urlencoded'"," body = args.nestedQuerystring ? qs.stringify(body) : querystring.stringify(body);"," if (body) {"," // if it's a GET or HEAD request, data should be sent as query string"," if (dataAsQueryString) {"," options.path += (parsedUrl.query ? '&' : '?') + body;"," body = null;"," if (body) {"," var length = body.length;"," if (!Buffer.isBuffer(body)) {"," length = Buffer.byteLength(body);"," requestSize = length;"," options.headers['content-length'] = length.toString();"," if (args.dataType === 'json') {"," if (!options.headers.accept) {"," options.headers.accept = 'application/json';"," if (typeof args.beforeRequest === 'function') {"," // you can use this hook to change every thing."," args.beforeRequest(options);"," var connectTimer = null;"," var responseTimer = null;"," var __err = null;"," var connected = false; // socket connected or not"," var keepAliveSocket = false; // request with keepalive socket"," var socketHandledRequests = 0; // socket already handled request count"," var socketHandledResponses = 0; // socket already handled response count"," var responseSize = 0;"," var statusCode = -1;"," var statusMessage = null;"," var responseAborted = false;"," var remoteAddress = '';"," var remotePort = '';"," var timing = null;"," if (args.timing) {"," timing = {"," // socket assigned"," queuing: 0,"," // dns lookup time"," dnslookup: 0,"," // socket connected"," connected: 0,"," // request sent"," requestSent: 0,"," // Time to first byte (TTFB)"," waiting: 0,"," contentDownload: 0,"," function cancelConnectTimer() {"," if (connectTimer) {"," clearTimeout(connectTimer);"," connectTimer = null;"," debug('Request#%d connect timer canceled', reqId);"," function cancelResponseTimer() {"," if (responseTimer) {"," clearTimeout(responseTimer);"," responseTimer = null;"," debug('Request#%d response timer canceled', reqId);"," function done(err, data, res) {"," cancelConnectTimer();"," cancelResponseTimer();"," if (!callback) {"," console.warn('[urllib:warn] [%s] [%s] [worker:%s] %s %s callback twice!!!',"," Date(), reqId, process.pid, options.method, url);"," // https://github.com/node-modules/urllib/pull/30"," console.warn('[urllib:warn] [%s] [%s] [worker:%s] %s: %s\\nstack: %s',"," Date(), reqId, process.pid, err.name, err.message, err.stack);"," return;"," var cb = callback;"," callback = null;"," var headers = {};"," if (res) {"," statusCode = res.statusCode;"," statusMessage = res.statusMessage;"," headers = res.headers;"," if (handleDigestAuth(res, cb)) {"," var response = createCallbackResponse(data, res);"," debug('[%sms] done, %s bytes HTTP %s %s %s %s, keepAliveSocket: %s, timing: %j, socketHandledRequests: %s, socketHandledResponses: %s',"," response.requestUseTime, responseSize, statusCode, options.method, options.host, options.path,"," keepAliveSocket, timing, socketHandledRequests, socketHandledResponses);"," var agentStatus = '';"," if (agent && typeof agent.getCurrentStatus === 'function') {"," // add current agent status to error message for logging and debug"," agentStatus = ', agent status: ' + JSON.stringify(agent.getCurrentStatus());"," err.message += ', ' + options.method + ' ' + url + ' ' + statusCode"," + ' (connected: ' + connected + ', keepalive socket: ' + keepAliveSocket + agentStatus"," + ', socketHandledRequests: ' + socketHandledRequests"," + ', socketHandledResponses: ' + socketHandledResponses + ')'"," + '\\nheaders: ' + JSON.stringify(headers);"," err.data = data;"," err.path = options.path;"," err.status = statusCode;"," err.headers = headers;"," err.res = response;"," addLongStackTrace(err, req);"," // only support agentkeepalive module for now"," // agentkeepalive@4: agent.options.freeSocketTimeout"," // agentkeepalive@3: agent.freeSocketKeepAliveTimeout"," var freeSocketTimeout = agent && (agent.options && agent.options.freeSocketTimeout || agent.freeSocketKeepAliveTimeout);"," if (agent && agent.keepAlive && freeSocketTimeout > 0 &&"," statusCode >= 200 && headers.connection === 'keep-alive' && headers['keep-alive']) {"," // adjust freeSocketTimeout on the socket"," var m = KEEP_ALIVE_RE.exec(headers['keep-alive']);"," if (m) {"," var seconds = parseInt(m[1]);"," if (seconds > 0) {"," // network delay 500ms"," var serverSocketTimeout = seconds * 1000 - 500;"," if (serverSocketTimeout < freeSocketTimeout) {"," // https://github.com/node-modules/agentkeepalive/blob/master/lib/agent.js#L127"," // agentkeepalive@4"," var socket = res.socket || (req && req.socket);"," if (agent.options && agent.options.freeSocketTimeout) {"," socket.freeSocketTimeout = serverSocketTimeout;"," socket.freeSocketKeepAliveTimeout = serverSocketTimeout;"," cb(err, data, args.streaming ? res : response);"," emitResponseEvent(err, response);"," function createAndEmitResponseEvent(data, res) {"," emitResponseEvent(null, response);"," function createCallbackResponse(data, res) {"," var requestUseTime = Date.now() - requestStartTime;"," if (timing) {"," timing.contentDownload = requestUseTime;"," var headers = res && res.headers || {};"," var resStatusCode = res && res.statusCode || statusCode;"," var resStatusMessage = res && res.statusMessage || statusMessage;"," status: resStatusCode,"," statusCode: resStatusCode,"," statusMessage: resStatusMessage,"," headers: headers,"," size: responseSize,"," aborted: responseAborted,"," rt: requestUseTime,"," keepAliveSocket: keepAliveSocket,"," requestUrls: args.requestUrls,"," timing: timing,"," remoteAddress: remoteAddress,"," remotePort: remotePort,"," socketHandledRequests: socketHandledRequests,"," socketHandledResponses: socketHandledResponses,"," function emitResponseEvent(err, response) {"," if (args.emitter) {"," // keep to use the same reqMeta object on request event before"," reqMeta.url = parsedUrl.href;"," reqMeta.socket = req && req.connection;"," reqMeta.options = options;"," reqMeta.size = requestSize;"," args.emitter.emit('response', {"," requestId: reqId,"," error: err,"," ctx: args.ctx,"," req: reqMeta,"," res: response,"," function handleDigestAuth(res, cb) {"," if (res && res.headers) {"," // handle digest auth"," if (statusCode === 401 && headers['www-authenticate']"," && !options.headers.authorization && args.digestAuth) {"," var authenticate = headers['www-authenticate'];"," if (authenticate.indexOf('Digest ') >= 0) {"," debug('Request#%d %s: got digest auth header WWW-Authenticate: %s', reqId, url, authenticate);"," options.headers.authorization = digestAuthHeader(options.method, options.path, authenticate, args.digestAuth);"," debug('Request#%d %s: auth with digest header: %s', reqId, url, options.headers.authorization);"," if (res.headers['set-cookie']) {"," options.headers.cookie = res.headers['set-cookie'].join(';');"," args.headers = options.headers;"," exports.requestWithCallback(url, args, cb);"," return true;"," return false;"," function handleRedirect(res) {"," var err = null;"," if (args.followRedirect && statuses.redirect[res.statusCode]) { // handle redirect"," args._followRedirectCount = (args._followRedirectCount || 0) + 1;"," var location = res.headers.location;"," if (!location) {"," err = new Error('Got statusCode ' + res.statusCode + ' but cannot resolve next location from headers');"," err.name = 'FollowRedirectError';"," } else if (args._followRedirectCount > args.maxRedirects) {"," err = new Error('Exceeded maxRedirects. Probably stuck in a redirect loop ' + url);"," err.name = 'MaxRedirectError';"," var newUrl = args.formatRedirectUrl ? args.formatRedirectUrl(url, location) : urlutil.resolve(url, location);"," debug('Request#%d %s: `redirected` from %s to %s', reqId, options.path, url, newUrl);"," // make sure timer stop"," cancelResponseTimer();"," // should clean up headers.host on `location: http://other-domain/url`"," if (options.headers.host && PROTO_RE.test(location)) {"," options.headers.host = null;"," args.headers = options.headers;"," // do not forward credential-bearing headers / auth to a different origin"," if (isCrossOriginRedirect(parsedUrl, newUrl)) {"," // Clone so this redirect-specific sanitization never corrupts the"," // caller's reusable options object."," var redirectArgs = Object.assign({}, args);"," var sensitiveHeaders = CROSS_ORIGIN_SENSITIVE_HEADERS;"," if (proxyTunnelAgent) {"," // Proxy-Authorization authenticates the (unchanged) proxy hop, not"," // the redirected origin, so keep it when the request is proxied."," sensitiveHeaders = sensitiveHeaders.filter(function (name) {"," return name !== 'proxy-authorization';"," });"," redirectArgs.headers = cleanCrossOriginHeaders(args.headers || options.headers, sensitiveHeaders);"," redirectArgs.auth = null;"," redirectArgs.digestAuth = null;"," args = redirectArgs;"," // avoid done will be execute in the future change."," var cb = callback;"," callback = null;"," exports.requestWithCallback(newUrl, args, cb);"," return {"," redirect: true,"," error: null"," };"," redirect: false,"," error: err"," // don't set user-agent"," if (args.headers && (args.headers['User-Agent'] === null || args.headers['user-agent'] === null)) {"," if (options.headers['user-agent']) {"," delete options.headers['user-agent'];"," // need to set user-agent"," var hasAgentHeader = options.headers['user-agent'];"," if (!hasAgentHeader) {"," options.headers['user-agent'] = USER_AGENT;"," if (args.gzip) {"," var isAcceptEncodingNull = (args.headers && (args.headers['Accept-Encoding'] === null || args.headers['accept-encoding'] === null));"," if (!isAcceptEncodingNull) {"," var hasAcceptEncodingHeader = options.headers['accept-encoding'];"," if (!hasAcceptEncodingHeader) {"," options.headers['accept-encoding'] = 'gzip, deflate';"," function decodeContent(res, body, cb) {"," if (responseAborted) {"," // err = new Error('Remote socket was terminated before `response.end()` was called');"," // err.name = 'RemoteSocketClosedError';"," debug('Request#%d %s: Remote socket was terminated before `response.end()` was called', reqId, url);"," var err = responseError || new Error('Remote socket was terminated before `response.end()` was called');"," return cb(err);"," var encoding = res.headers['content-encoding'];"," if (body.length === 0 || !encoding) {"," return cb(null, body, encoding);"," encoding = encoding.toLowerCase();"," switch (encoding) {"," case 'gzip':"," case 'deflate':"," debug('unzip %d length body', body.length);"," zlib.unzip(body, function(err, data) {"," if (err && err.name === 'Error') {"," err.name = 'UnzipError';"," cb(err, data);"," });"," break;"," default:"," cb(null, body, encoding);"," var writeStream = args.writeStream;"," var isWriteStreamClose = false;"," debug('Request#%d %s %s with headers %j, options.path: %s',"," reqId, method, url, options.headers, options.path);"," args.requestUrls.push(parsedUrl.href);"," var hasResponse = false;"," var responseError;"," function onResponse(res) {"," hasResponse = true;"," socketHandledResponses = res.socket[SOCKET_RESPONSE_COUNT] = (res.socket[SOCKET_RESPONSE_COUNT] || 0) + 1;"," timing.waiting = Date.now() - requestStartTime;"," debug('Request#%d %s `req response` event emit: status %d, headers: %j',"," reqId, url, res.statusCode, res.headers);"," if (args.streaming) {"," var result = handleRedirect(res);"," if (result.redirect) {"," res.resume();"," createAndEmitResponseEvent(null, res);"," return;"," if (result.error) {"," return done(result.error, null, res);"," return done(null, null, res);"," res.on('error', function (err) {"," responseError = err;"," debug('Request#%d %s: `res error` event emit, total size %d, socket handled %s requests and %s responses',"," reqId, url, responseSize, socketHandledRequests, socketHandledResponses);"," res.on('aborted', function () {"," responseAborted = true;"," debug('Request#%d %s: `res aborted` event emit, total size %d',"," reqId, url, responseSize);"," if (writeStream) {"," // If there's a writable stream to recieve the response data, just pipe the"," // response stream to that writable stream and call the callback when it has"," // finished writing."," //"," // NOTE that when the response stream `res` emits an 'end' event it just"," // means that it has finished piping data to another stream. In the"," // meanwhile that writable stream may still writing data to the disk until"," // it emits a 'close' event."," // That means that we should not apply callback until the 'close' of the"," // writable stream is emited."," // See also:"," // - https://github.com/TBEDP/urllib/commit/959ac3365821e0e028c231a5e8efca6af410eabb"," // - http://nodejs.org/api/stream.html#stream_event_end"," // - http://nodejs.org/api/stream.html#stream_event_close_1"," // end ths stream first"," writeStream.end();"," done(result.error, null, res);"," // you can set consumeWriteStream false that only wait response end"," if (args.consumeWriteStream === false) {"," res.on('end', done.bind(null, null, null, res));"," pump(res, writeStream, function(err) {"," if (isWriteStreamClose) {"," return;"," isWriteStreamClose = true;"," debug('Request#%d %s: writeStream close, error: %s', reqId, url, err);"," // node 0.10, 0.12: only emit res aborted, writeStream close not fired"," if (isNode010 || isNode012) {"," first(["," [ writeStream, 'close' ],"," [ res, 'aborted' ],"," ], function(_, stream, event) {"," debug('Request#%d %s: writeStream or res %s event emitted', reqId, url, event);"," done(__err || null, null, res);"," res.pipe(writeStream);"," debug('Request#%d %s: pump res to writeStream', reqId, url);"," pump(res, writeStream, function(err) {"," debug('Request#%d %s: writeStream close event emitted, error: %s, isWriteStreamClose: %s',"," reqId, url, err, isWriteStreamClose);"," if (isWriteStreamClose) {"," return;"," isWriteStreamClose = true;"," done(__err || err, null, res);"," // Otherwise, just concat those buffers."," //"," // NOTE that the `chunk` is not a String but a Buffer. It means that if"," // you simply concat two chunk with `+` you're actually converting both"," // Buffers into Strings before concating them. It'll cause problems when"," // dealing with multi-byte characters."," // The solution is to store each chunk in an array and concat them with"," // 'buffer-concat' when all chunks is recieved."," // See also:"," // http://cnodejs.org/topic/4faf65852e8fb5bc65113403"," var chunks = [];"," res.on('data', function (chunk) {"," debug('Request#%d %s: `res data` event emit, size %d', reqId, url, chunk.length);"," responseSize += chunk.length;"," chunks.push(chunk);"," var isEmitted = false;"," function handleResponseCloseAndEnd(event) {"," debug('Request#%d %s: `res %s` event emit, total size %d, socket handled %s requests and %s responses',"," reqId, url, event, responseSize, socketHandledRequests, socketHandledResponses);"," if (isEmitted) {"," isEmitted = true;"," var body = Buffer.concat(chunks, responseSize);"," debug('Request#%d %s: _dumped: %s',"," reqId, url, res._dumped);"," if (__err) {"," // req.abort() after `res data` event emit."," return done(__err, body, res);"," return done(result.error, body, res);"," decodeContent(res, body, function (err, data, encoding) {"," if (err) {"," return done(err, body, res);"," // if body not decode, dont touch it"," if (!encoding && TEXT_DATA_TYPES.indexOf(args.dataType) >= 0) {"," // try to decode charset"," try {"," data = decodeBodyByCharset(data, res);"," } catch (e) {"," debug('decodeBodyByCharset error: %s', e);"," // if error, dont touch it"," return done(null, data, res);"," if (args.dataType === 'json') {"," if (responseSize === 0) {"," data = null;"," var r = parseJSON(data, fixJSONCtlChars);"," if (r.error) {"," err = r.error;"," } else {"," data = r.data;"," }"," done(err, data, res);"," // node >= 14 only emit close if req abort"," res.on('close', function () {"," handleResponseCloseAndEnd('close');"," res.on('end', function () {"," handleResponseCloseAndEnd('end');"," var connectTimeout, responseTimeout;"," if (Array.isArray(args.timeout)) {"," connectTimeout = ms(args.timeout[0]);"," responseTimeout = ms(args.timeout[1]);"," } else { // set both timeout equal"," connectTimeout = responseTimeout = ms(args.timeout);"," debug('ConnectTimeout: %d, ResponseTimeout: %d', connectTimeout, responseTimeout);"," function startConnectTimer() {"," debug('Connect timer ticking, timeout: %d', connectTimeout);"," connectTimer = setTimeout(function () {"," if (statusCode === -1) {"," statusCode = -2;"," var msg = 'Connect timeout for ' + connectTimeout + 'ms';"," var errorName = 'ConnectionTimeoutError';"," if (!req.socket) {"," errorName = 'SocketAssignTimeoutError';"," msg += ', working sockets is full';"," __err = new Error(msg);"," __err.name = errorName;"," __err.requestId = reqId;"," debug('ConnectTimeout: Request#%d %s %s: %s, connected: %s', reqId, url, __err.name, msg, connected);"," abortRequest();"," }, connectTimeout);"," function startResposneTimer() {"," debug('Response timer ticking, timeout: %d', responseTimeout);"," responseTimer = setTimeout(function () {"," var msg = 'Response timeout for ' + responseTimeout + 'ms';"," var errorName = 'ResponseTimeoutError';"," debug('ResponseTimeout: Request#%d %s %s: %s, connected: %s', reqId, url, __err.name, msg, connected);"," }, responseTimeout);"," var hostname = parsedUrl.hostname;"," // if request hostname is ip, custom lookup wont execute"," var family = null;"," if (net.isIPv4(hostname)) {"," family = 4;"," } else if (net.isIPv6(hostname)) {"," family = 6;"," if (family) {"," if (!args.checkAddress(hostname, family, hostname)) {"," var err = new Error('illegal address');"," err.name = 'IllegalAddressError';"," err.hostname = hostname;"," err.ip = hostname;"," err.family = family;"," return done(err);"," // request headers checker will throw error"," var finalOptions = options;"," // restore origin header key"," if (args.keepHeaderCase) {"," var originKeys = Object.keys(originHeaderKeys);"," if (originKeys.length) {"," var finalHeaders = {};"," var names = utility.getOwnEnumerables(options.headers, true);"," for (var i = 0; i < names.length; i++) {"," var name = names[i];"," finalHeaders[originHeaderKeys[name] || name] = options.headers[name];"," finalOptions = Object.assign({}, options);"," finalOptions.headers = finalHeaders;"," req = httplib.request(finalOptions, onResponse);"," if (args.trace) {"," req._callSite = {};"," Error.captureStackTrace(req._callSite, requestWithCallback);"," return done(err);"," // environment detection: browser or nodejs"," if (typeof(window) === 'undefined') {"," // start connect timer just after `request` return, and just in nodejs environment"," startConnectTimer();"," var isRequestAborted = false;"," function abortRequest() {"," if (isRequestAborted) {"," isRequestAborted = true;"," debug('Request#%d %s abort, connected: %s', reqId, url, connected);"," // it wont case error event when req haven't been assigned a socket yet."," if (!req.socket) {"," __err.noSocket = true;"," done(__err);"," req.abort();"," if (timing) {"," // request sent"," req.on('finish', function() {"," timing.requestSent = Date.now() - requestStartTime;"," req.once('socket', function (socket) {"," // socket queuing time"," timing.queuing = Date.now() - requestStartTime;"," // https://github.com/nodejs/node/blob/master/lib/net.js#L377"," // https://github.com/nodejs/node/blob/v0.10.40-release/lib/net.js#L352"," // should use socket.socket on 0.10.x"," if (isNode010 && socket.socket) {"," socket = socket.socket;"," var orginalSocketTimeout = getSocketTimeout(socket);"," if (orginalSocketTimeout && orginalSocketTimeout < responseTimeout) {"," // make sure socket live longer than the response timer"," var socketTimeout = responseTimeout + 500;"," debug('Request#%d socket.timeout(%s) < responseTimeout(%s), reset socket timeout to %s',"," reqId, orginalSocketTimeout, responseTimeout, socketTimeout);"," socket.setTimeout(socketTimeout);"," socketHandledRequests = socket[SOCKET_REQUEST_COUNT] = (socket[SOCKET_REQUEST_COUNT] || 0) + 1;"," if (socket[SOCKET_RESPONSE_COUNT]) {"," socketHandledResponses = socket[SOCKET_RESPONSE_COUNT];"," var readyState = socket.readyState;"," if (readyState === 'opening') {"," socket.once('lookup', function(err, ip, addressType) {"," debug('Request#%d %s lookup: %s, %s, %s', reqId, url, err, ip, addressType);"," if (timing) {"," timing.dnslookup = Date.now() - requestStartTime;"," if (ip) {"," remoteAddress = ip;"," socket.once('connect', function() {"," // socket connected"," timing.connected = Date.now() - requestStartTime;"," // cancel socket timer at first and start tick for TTFB"," cancelConnectTimer();"," startResposneTimer();"," debug('Request#%d %s new socket connected', reqId, url);"," connected = true;"," if (!remoteAddress) {"," remoteAddress = socket.remoteAddress;"," remotePort = socket.remotePort;"," debug('Request#%d %s reuse socket connected, readyState: %s', reqId, url, readyState);"," connected = true;"," keepAliveSocket = true;"," if (!remoteAddress) {"," remoteAddress = socket.remoteAddress;"," remotePort = socket.remotePort;"," // reuse socket, timer should be canceled."," startResposneTimer();"," if (writeStream) {"," writeStream.once('error', function(err) {"," err.message += ' (writeStream \"error\")';"," __err = err;"," debug('Request#%d %s `writeStream error` event emit, %s: %s', reqId, url, err.name, err.message);"," var isRequestDone = false;"," function handleRequestError(err) {"," if (!err) {"," // only ignore request error if response has been received"," // if response has not received, socket error will emit on req"," if (isRequestDone && hasResponse) {"," isRequestDone = true;"," if (err.name === 'Error') {"," err.name = connected ? 'ResponseError' : 'RequestError';"," debug('Request#%d %s `req error` event emit, %s: %s', reqId, url, err.name, err.message);"," done(__err || err);"," if (args.stream) {"," debug('Request#%d pump args.stream to req', reqId);"," pump(args.stream, req, handleRequestError);"," req.end(body, function () {"," isRequestDone = true;"," // when stream already consumed, req's `finish` event is emitted and pump will ignore error after pipe finished"," // but if server response timeout later, we will abort the request and emit an error in req"," // so we must always manually listen to req's `error` event here to ensure this error is handled"," req.on('error', handleRequestError);"," req.requestId = reqId;"," return req;","exports.requestWithCallback = requestWithCallback;","var JSONCtlCharsMap = {"," '\"': '\\\\\"', // \\u0022"," '\\\\': '\\\\\\\\', // \\u005c"," '\\b': '\\\\b', // \\u0008"," '\\f': '\\\\f', // \\u000c"," '\\n': '\\\\n', // \\u000a"," '\\r': '\\\\r', // \\u000d"," '\\t': '\\\\t' // \\u0009","var JSONCtlCharsRE = /[\\u0000-\\u001F\\u005C]/g;","function _replaceOneChar(c) {"," return JSONCtlCharsMap[c] || '\\\\u' + (c.charCodeAt(0) + 0x10000).toString(16).substr(1);","function replaceJSONCtlChars(str) {"," return str.replace(JSONCtlCharsRE, _replaceOneChar);","function parseJSON(data, fixJSONCtlChars) {"," var result = {"," error: null,"," data: null"," if (fixJSONCtlChars) {"," if (typeof fixJSONCtlChars === 'function') {"," data = fixJSONCtlChars(data);"," // https://github.com/node-modules/urllib/pull/77"," // remote the control characters (U+0000 through U+001F)"," data = replaceJSONCtlChars(data);"," result.data = JSON.parse(data);"," if (err.name === 'SyntaxError') {"," err.name = 'JSONResponseFormatError';"," if (data.length > 1024) {"," // show 0~512 ... -512~end data"," err.message += ' (data json format: ' +"," JSON.stringify(data.slice(0, 512)) + ' ...skip... ' + JSON.stringify(data.slice(data.length - 512)) + ')';"," err.message += ' (data json format: ' + JSON.stringify(data) + ')';"," result.error = err;"," return result;"," * decode response body by parse `content-type`'s charset"," * @param {Buffer} data"," * @param {Http(s)Response} res"," * @return {String}","function decodeBodyByCharset(data, res) {"," var type = res.headers['content-type'];"," if (!type) {"," return data.toString();"," var type = parseContentType(type);"," var charset = type.parameters.charset || 'utf-8';"," if (!Buffer.isEncoding(charset)) {"," if (!_iconv) {"," _iconv = require('iconv-lite');"," return _iconv.decode(data, charset);"," return data.toString(charset);","function getAgent(agent, defaultAgent) {"," return agent === undefined ? defaultAgent : agent;","function parseContentType(str) {"," return contentTypeParser.parse(str);"," // ignore content-type error, tread as default"," return { parameters: {} };","function addLongStackTrace(err, req) {"," if (!req) {"," return;"," var callSiteStack = req._callSite && req._callSite.stack;"," if (!callSiteStack || typeof callSiteStack !== 'string') {"," if (err._longStack) {"," var index = callSiteStack.indexOf('\\n');"," if (index !== -1) {"," err._longStack = true;"," err.stack += LONG_STACK_DELIMITER + callSiteStack.substr(index + 1);","// node 8 don't has timeout attribute on socket","// https://github.com/nodejs/node/pull/21204/files#diff-e6ef024c3775d787c38487a6309e491dR408","function getSocketTimeout(socket) {"," return socket.timeout || socket._idleTimeout;",[1880,1881,1882,1883,1884,1885,1886,1887,1888],{"_791":45,"_45":1902},{"_791":1890,"_164":903,"_814":1900,"_816":1901},{"_791":45,"_45":1899},{"_791":1890,"_164":903,"_814":1897,"_816":1898},{"_791":45,"_45":1896},{"_791":1890,"_164":903,"_814":1894,"_816":1895},{"_791":45,"_45":1893},{"_791":1890,"_164":808,"_814":1891,"_816":1892},{"_791":45,"_45":1889},"\n* No code changes were needed, so I did not create a new commit or pull request.\n\n**Testing**\n* ✅ `./node_modules/.bin/mocha -t 30000 test/redirect-cross-origin.test.js`\n* ❌ `npm test -- --grep redirect-cross-origin` — this was an invalid invocation for this repo’s npm scripts because the grep argument was forwarded as an extra file pattern; it ran broader tests and failed outside the targeted redirect test path.","repo_file_citation",63,135,"\n* Confirmed regression coverage exists for stripping cross-origin credential headers, preserving same-origin credential headers, stripping cross-origin `auth`, preserving same-origin `auth`, and not mutating the caller’s reusable options object. ",756,772,"\n * Cross-origin redirects clone `args`, conditionally preserve `Proxy-Authorization` when a proxy tunnel is in use, and clear auth only on the redirect clone. ",104,115,"\n * The fallback parser compares protocol, hostname, and normalized default ports, and parser errors fail closed. ",73,99,"### Summary\n\n* Reviewed the current PR head and confirmed the three follow-up points in the trigger are already present:\n * Options-style request objects without `href` are handled by deriving an origin href from `host`/`hostname`, `port`, and `path`, while undeterminable origins fail closed. ",{"_90":330,"_41":82,"_94":330,"_1905":1906,"_1907":1908,"_1909":1910,"_130":-5,"_117":1911},[81],"input_items",[1929,1930,1931,1932,1933,1934,1935,1936,1937,1938,1939,1940],"external_post_config",{"_1912":1913,"_267":202,"_1914":309,"_278":-5,"_1915":261,"_1916":-5,"_1917":1918,"_1919":1920,"_1921":-5,"_1922":-5,"_1923":1924,"_1925":15,"_1926":57,"_1927":52,"_1928":15},"user_model_slug","slug",1781361110.325095,"installation_id",124467515,"pr_number","repo_id","review_trigger","comment_id",4698807207,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",369618245,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_90":434,"_94":330,"_429":1959},{"_316":317,"_318":319,"_1956":324,"_1957":127,"_326":-5,"_90":1958},{"_90":1941,"_318":1955,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1954,"_164":903,"_1943":1947,"_1944":-5},{"_90":1941,"_318":1953,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1952,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1951,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1950,"_164":903,"_1943":1947,"_1944":-5},{"_90":1941,"_318":1948,"_164":903,"_1943":1947,"_1944":1949},{"_90":1941,"_318":1946,"_164":903,"_1943":1947,"_1944":-5},{"_90":1941,"_318":1945,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1942,"_164":-5,"_1943":-5,"_1944":-5},"pull_request_comment","## [Codecov](https://app.codecov.io/gh/node-modules/urllib/pull/813?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) Report\n:x: Patch coverage is `75.00000%` with `6 lines` in your changes missing coverage. Please review.\n:white_check_mark: Project coverage is 91.09%. Comparing base ([`02cad0e`](https://app.codecov.io/gh/node-modules/urllib/commit/02cad0ecc16024a4182683bbccab701d30b59ad7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules)) to head ([`e967cbf`](https://app.codecov.io/gh/node-modules/urllib/commit/e967cbf17c375c590e6fb4e679975b7216c9453e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules)).\n:warning: Report is 2 commits behind head on 2.x.\n\n| [Files with missing lines](https://app.codecov.io/gh/node-modules/urllib/pull/813?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) | Patch % | Lines |\n|---|---|---|\n| [lib/urllib.js](https://app.codecov.io/gh/node-modules/urllib/pull/813?src=pr&el=tree&filepath=lib%2Furllib.js&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules#diff-bGliL3VybGxpYi5qcw==) | 75.00% | [6 Missing :warning: ](https://app.codecov.io/gh/node-modules/urllib/pull/813?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=node-modules) |\n\n

Additional details and impacted files

:rocket: New features to boost your workflow:

","side","line","\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `1e81b9225c`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Avoid clearing caller auth options in place**\n\nWhen a caller reuses the same options object after a request that followed a cross-origin redirect, these assignments permanently replace their `auth`/`digestAuth` values with `null`. The next request with that options object no longer authenticates even if it is sent directly to the original origin; clone the redirect args before dropping credentials so redirect-specific sanitization does not corrupt the caller's reusable options.\n\nUseful? React with 👍 / 👎.","RIGHT","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve proxy auth when reusing the same proxy**\n\nFor proxied requests where the caller pins a proxy with `args.proxy`/`URLLIB_PROXY` and supplies `Proxy-Authorization` in the request headers, a redirect to another origin still goes through that same authenticated proxy, but this list removes the proxy credential before the recursive request. In that context the header authenticates the proxy rather than the redirected origin, so authenticated proxies can start returning 407 on any cross-origin redirect; only strip it when it is actually being sent as an origin header rather than while proxying.\n\nUseful? React with 👍 / 👎.",71,"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve credentials on same-origin object redirects**\n\nWhen the original request is made with an HTTP options-style object that does not include `href` (the function accepts object URLs and builds `options.host`/`options.path` from them), `parsedUrl.href` is `undefined`, so `isCrossOriginRedirect()` throws and returns `true`. That means even a relative redirect back to the same host strips `Authorization`/`Cookie` and clears `args.auth`, breaking authenticated same-origin redirects for this supported call form; build the origin from the parsed request fields/options instead of relying only on `parsedUrl.href`.\n\nUseful? React with 👍 / 👎.","@codex review","Thanks, both points addressed in the fallback parser (the `urlutil.parse` branch, only used when the WHATWG `URL` global is unavailable):\n\n1. **Default-port normalization**: now compares `protocol` + `hostname` + a normalized port (defaulting to 443/80) instead of the raw `host`, so same-origin redirects with an explicit `:80`/`:443` are no longer treated as cross-origin.\n2. **Fail closed**: the `catch` now returns `true`, so if the origin can't be determined the credentials are stripped rather than forwarded.\n\nThe primary path uses `URL.origin`, which already normalizes default ports and throws on a malformed location before the strip runs, so it was unaffected; the change is limited to the fallback.","## Code Review\n\nThis pull request introduces security enhancements to prevent credential leakage by stripping sensitive headers (such as Authorization, Cookie, and Proxy-Authorization) and clearing authentication options during cross-origin redirects, while preserving them for same-origin redirects. Feedback on these changes highlights two critical issues in the fallback parser of `isCrossOriginRedirect`: first, comparing unnormalized hosts can cause same-origin redirects with explicit default ports to be incorrectly treated as cross-origin; second, the parser fails open by returning `false` on errors, which could leak credentials. It is recommended to normalize the ports and fail closed by returning `true` in the catch block.\n\n> [!IMPORTANT]\n> The [consumer version of Gemini Code Assist on GitHub](https://developers.google.com/gemini-code-assist/docs/review-repo-code) is being sunset. Starting **June 18, 2026**, new organization installations will be blocked, and all code review activity will officially cease on **July 17, 2026**.\n> For more details on the timeline and next steps, please review the [Help Documentation](https://developers.google.com/gemini-code-assist/docs/deprecations/consumer-code-review).","![high](https://www.gstatic.com/codereviewagent/high-priority.svg)\n\n### Issue 1: Inconsistent Same-Origin Detection in Fallback Parser\nIn the fallback path (when `URL` is not available, e.g., in older Node.js versions), comparing `from.host !== to.host` can incorrectly treat same-origin redirects as cross-origin if one URL explicitly includes the default port (e.g., `:80` for HTTP or `:443` for HTTPS) and the other does not. This is because `urlutil.parse` does not normalize default ports in the `host` property (unlike the modern `URL` API). This would cause sensitive headers to be stripped on legitimate same-origin redirects.\n\n### Issue 2: Unsafe Fail-Open on Parser Error\nIf `isCrossOriginRedirect` throws an error during parsing, returning `false` in the `catch` block means the redirect is assumed to be same-origin, and credentials will be forwarded. To prevent potential credential leakage on malformed or unexpected redirect URLs, the fallback should fail-closed by returning `true` (treating it as cross-origin).\n\n### Suggestion\nNormalize the ports in the fallback comparison and return `true` in the `catch` block to ensure a secure, fail-closed behavior.\n\n```javascript\nfunction isCrossOriginRedirect(fromHref, toUrl) {\n try {\n if (URL) {\n return new URL(fromHref).origin !== new URL(toUrl, fromHref).origin;\n }\n var from = urlutil.parse(fromHref);\n var to = urlutil.parse(urlutil.resolve(fromHref, toUrl));\n var fromPort = from.port || (from.protocol === 'https:' ? '443' : '80');\n var toPort = to.port || (to.protocol === 'https:' ? '443' : '80');\n return from.protocol !== to.protocol || from.hostname !== to.hostname || fromPort !== toPort;\n } catch (err) {\n return true;\n }\n}\n```","\n\n\n> [!IMPORTANT]\n> ## Review skipped\n> \n> Auto reviews are disabled on base/target branches other than the default branch.\n> \n> \n> \n> Please check the settings in the CodeRabbit UI or the `.coderabbit.yaml` file in this repository. To trigger a single review, invoke the `@coderabbitai review` command.\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: defaults\n> \n> **Review profile**: CHILL\n> \n> **Plan**: Pro\n> \n> **Run ID**: `2739d02f-4442-4e48-9c3c-b5192cb9d48e`\n> \n>

✨ Finishing Touches

\n\n

🧪 Generate unit tests (beta)

\n\n- [ ] Create PR with unit tests\n- [ ] Commit unit tests in branch `fix/cross-origin-redirect-credential-leak-2.x`\n\n

\n\n

❤️ Share

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands and usage tips.}\n\n","base_ref","head_ref","pull_request_info",[1960],{"_791":45,"_45":1961},"Thanks @chatgpt-codex-connector, all three addressed in 44c1935:\n\n1. **Don't clear caller auth in place** - the cross-origin branch now clones `args` (`Object.assign({}, args)`) and drops `auth`/`digestAuth`/credential headers on the clone, so reusing the same options object after a redirect still authenticates against the original origin. Added a regression test asserting `opts.auth`/`opts.headers` are untouched.\n\n2. **Preserve proxy auth when proxied** - when a proxy tunnel is in use (`proxyTunnelAgent`), `Proxy-Authorization` is kept (it authenticates the unchanged proxy hop, not the redirected origin), so pinned authenticated proxies no longer 407 on cross-origin redirects. It's still stripped when there's no proxy (where it would otherwise reach the target origin).\n\n3. **Same-origin object-URL redirects** - origin detection now derives an href from the parsed URL components (`host`/`hostname`/`port`/`path`) when the caller passes an options-style object without `href`, so same-origin redirects are detected correctly instead of hitting the fail-closed path and stripping credentials. (Truly-undeterminable origins still fail closed.)\n\nThe Gemini fallback-parser points (default-port normalization + fail-closed) from the earlier review are already in.",[2250,2251],[],{"_796":797,"_45":798,"_799":800},{"_771":2241},{"_344":2240},{"_344":2000},{"_308":309,"_299":310,"_311":312,"_313":15,"_314":57,"_315":15,"_316":317,"_318":319,"_320":321,"_322":125,"_323":324,"_325":127,"_326":327,"_328":-5,"_329":-5,"_330":1999,"_332":333,"_334":335,"_336":337,"_338":339},{"_41":121,"_199":200,"_201":202,"_203":15,"_204":205,"_206":207,"_208":1988,"_210":-5,"_211":-5,"_212":1989,"_214":205,"_215":205,"_216":1990,"_218":1991,"_220":1992,"_222":-5,"_223":224,"_225":226,"_227":228,"_229":1993,"_53":-5,"_117":231,"_232":1994,"_234":1995,"_236":237,"_238":15,"_239":15},{"_131":1983},[1972,1973,1974,1975,1976,1977,1978,1979,1980,1981,1982],{"_151":183,"_153":154,"_155":156,"_157":166,"_159":175,"_161":162,"_163":31,"_164":-5},{"_151":181,"_153":154,"_155":156,"_157":166,"_159":182,"_161":162,"_163":31,"_164":-5},{"_151":179,"_153":154,"_155":156,"_157":158,"_159":180,"_161":162,"_163":31,"_164":-5},{"_151":178,"_153":154,"_155":156,"_157":158,"_159":169,"_161":162,"_163":31,"_164":-5},{"_151":176,"_153":154,"_155":156,"_157":168,"_159":169,"_161":162,"_163":177,"_164":-5},{"_151":174,"_153":154,"_155":156,"_157":166,"_159":175,"_161":162,"_163":31,"_164":-5},{"_151":173,"_153":154,"_155":156,"_157":158,"_159":169,"_161":162,"_163":31,"_164":-5},{"_151":171,"_153":154,"_155":156,"_157":168,"_159":169,"_161":162,"_163":172,"_164":-5},{"_151":167,"_153":154,"_155":156,"_157":168,"_159":169,"_161":162,"_163":170,"_164":-5},{"_151":165,"_153":154,"_155":156,"_157":166,"_159":160,"_161":162,"_163":31,"_164":-5},{"_151":152,"_153":154,"_155":156,"_157":158,"_159":160,"_161":162,"_163":31,"_164":-5},[1984,1985],{"_187":1987,"_189":196},{"_187":1986,"_189":190},{"_191":192,"_90":193,"_117":194},{"_191":197,"_90":193,"_117":198},{"_301":302,"_303":304,"_305":205,"_306":-5,"_307":-5},[261],{"_261":1996},{"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260},{},[],{"_242":57},{"_240":57,"_241":205},{"_41":263,"_191":264,"_265":1997,"_267":202,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":62,"_279":15,"_280":-5,"_281":-5,"_282":-5,"_283":-5,"_284":-5,"_285":-5,"_163":286,"_287":-5,"_53":1998},{"_293":294,"_41":295,"_90":296,"_297":298,"_299":300},{"_289":15,"_290":15,"_291":15,"_292":15},{"_293":340,"_191":340,"_341":-5,"_297":342,"_41":343},[2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021,2022,2023,2024,2025,2026,2027,2028,2029,2030,2031,2032,2033,2034,2035,2036,2037,2038,2039,2040,2041,2042,2043,2044,2045,2046,2047,2048,2049,2050,2051,2052,2053,2054,2055,2056,2057,2058],{"_157":750,"_405":2236},{"_157":420,"_405":2233},{"_157":740,"_405":2230},{"_157":424,"_405":2225},{"_157":424,"_405":2221},{"_157":424,"_405":2217},{"_157":438,"_405":2212},{"_157":438,"_405":2208},{"_157":424,"_405":2204},{"_157":424,"_405":2202},{"_157":438,"_405":2198},{"_157":424,"_405":2196},{"_157":438,"_405":2192},{"_157":424,"_405":2189},{"_157":424,"_405":2187},{"_157":438,"_405":2183},{"_157":424,"_405":2181},{"_157":438,"_405":2177},{"_157":424,"_405":2174},{"_157":424,"_405":2172},{"_157":438,"_405":2167},{"_157":424,"_405":2165},{"_157":424,"_405":2163},{"_157":438,"_405":2158},{"_157":424,"_405":2156},{"_157":424,"_405":2154},{"_157":438,"_405":2150},{"_157":424,"_405":2148},{"_157":424,"_405":2146},{"_157":438,"_405":2142},{"_157":424,"_405":2140},{"_157":438,"_405":2136},{"_157":424,"_405":2133},{"_157":424,"_405":2131},{"_157":438,"_405":2127},{"_157":424,"_405":2125},{"_157":424,"_405":2123},{"_157":424,"_405":2121},{"_157":438,"_405":2117},{"_157":438,"_405":2113},{"_157":424,"_405":2109},{"_157":424,"_405":2107},{"_157":424,"_405":2105},{"_157":438,"_405":2101},{"_157":438,"_405":2097},{"_157":424,"_405":2094},{"_157":424,"_405":2092},{"_157":438,"_405":2087},{"_157":424,"_405":2085},{"_157":424,"_405":2083},{"_157":438,"_405":2079},{"_157":424,"_405":2077},{"_157":438,"_405":2073},{"_157":424,"_405":2070},{"_157":438,"_405":2068},{"_157":424,"_405":2064},{"_157":420,"_405":2062},{"_157":404,"_405":2059},{"_407":408,"_85":2060},{"_410":411,"_412":413,"_101":-5,"_41":414,"_415":2061,"_417":418,"_419":111},[],{"_419":2063,"_407":408},{"_90":423},{"_426":2065,"_407":408,"_428":414},{"_429":2066,"_431":-5,"_41":-5,"_432":433,"_94":91,"_90":434},[2067],{"_45":436,"_90":437},{"_426":2069,"_407":408,"_428":414},{"_41":441,"_432":433,"_45":436,"_90":442},{"_426":2071,"_407":408,"_428":414},{"_429":-5,"_445":446,"_41":-5,"_447":2072,"_90":449},[],{"_426":2074,"_407":408,"_428":414},{"_429":2075,"_41":453,"_447":2076,"_90":449},[],[],{"_426":2078,"_407":408,"_428":414},{"_457":458,"_459":460,"_90":461},{"_426":2080,"_407":408,"_428":414},{"_464":465,"_466":467,"_468":2081,"_470":471,"_412":31,"_472":31,"_41":458,"_473":474,"_475":476,"_419":111,"_90":477},[2082],{"_466":479,"_90":480},{"_426":2084,"_407":408,"_428":414},{"_483":484,"_457":458,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2086,"_407":408,"_428":414},{"_457":490,"_459":491,"_90":461},{"_426":2088,"_407":408,"_428":414},{"_464":494,"_466":495,"_468":2089,"_470":471,"_412":31,"_472":31,"_41":490,"_473":497,"_475":476,"_419":111,"_90":477},[2090,2091],{"_466":504,"_191":505,"_164":506,"_90":503},{"_466":500,"_191":501,"_164":502,"_90":503},{"_426":2093,"_407":408,"_428":414},{"_483":509,"_457":490,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2095,"_407":408,"_428":414},{"_429":-5,"_445":512,"_41":-5,"_447":2096,"_90":449},[],{"_426":2098,"_407":408,"_428":414},{"_429":2099,"_41":517,"_447":2100,"_90":449},[],[],{"_426":2102,"_407":408,"_428":414},{"_464":521,"_466":522,"_468":2103,"_470":471,"_412":524,"_472":31,"_41":525,"_473":526,"_475":476,"_419":111,"_90":477},[2104],{"_466":528,"_90":480},{"_426":2106,"_407":408,"_428":414},{"_457":525,"_459":531,"_90":461},{"_426":2108,"_407":408,"_428":414},{"_483":534,"_457":525,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2110,"_407":408,"_428":414},{"_429":-5,"_445":537,"_41":-5,"_447":2111,"_90":449},[2112],{"_45":540,"_90":541},{"_426":2114,"_407":408,"_428":414},{"_429":2115,"_41":545,"_447":2116,"_90":449},[],[540],{"_426":2118,"_407":408,"_428":414},{"_464":549,"_466":550,"_468":2119,"_470":471,"_412":552,"_472":553,"_41":554,"_473":555,"_475":476,"_419":556,"_90":477},[2120],{"_466":558,"_90":480},{"_426":2122,"_407":408,"_428":414},{"_457":554,"_459":561,"_90":461},{"_426":2124,"_407":408,"_428":414},{"_483":564,"_457":554,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2126,"_407":408,"_428":414},{"_457":567,"_459":568,"_90":461},{"_426":2128,"_407":408,"_428":414},{"_464":571,"_466":572,"_468":2129,"_470":471,"_412":31,"_472":31,"_41":567,"_473":574,"_475":476,"_419":111,"_90":477},[2130],{"_466":576,"_191":577,"_164":578,"_90":503},{"_426":2132,"_407":408,"_428":414},{"_483":581,"_457":567,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2134,"_407":408,"_428":414},{"_429":-5,"_445":584,"_41":-5,"_447":2135,"_90":449},[],{"_426":2137,"_407":408,"_428":414},{"_429":2138,"_41":589,"_447":2139,"_90":449},[],[],{"_426":2141,"_407":408,"_428":414},{"_457":593,"_459":594,"_90":461},{"_426":2143,"_407":408,"_428":414},{"_464":597,"_466":598,"_468":2144,"_470":471,"_412":31,"_472":31,"_41":593,"_473":600,"_475":476,"_419":111,"_90":477},[2145],{"_466":602,"_191":505,"_164":506,"_90":503},{"_426":2147,"_407":408,"_428":414},{"_483":605,"_457":593,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2149,"_407":408,"_428":414},{"_457":608,"_459":609,"_90":461},{"_426":2151,"_407":408,"_428":414},{"_464":612,"_466":613,"_468":2152,"_470":471,"_412":31,"_472":31,"_41":608,"_473":615,"_475":476,"_419":111,"_90":477},[2153],{"_466":617,"_191":505,"_164":506,"_90":503},{"_426":2155,"_407":408,"_428":414},{"_483":620,"_457":608,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2157,"_407":408,"_428":414},{"_457":623,"_459":624,"_90":461},{"_426":2159,"_407":408,"_428":414},{"_464":627,"_466":628,"_468":2160,"_470":471,"_412":31,"_472":31,"_41":623,"_473":630,"_475":476,"_419":111,"_90":477},[2161,2162],{"_466":634,"_191":505,"_164":506,"_90":503},{"_466":633,"_191":505,"_164":506,"_90":503},{"_426":2164,"_407":408,"_428":414},{"_483":637,"_457":623,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2166,"_407":408,"_428":414},{"_457":640,"_459":641,"_90":461},{"_426":2168,"_407":408,"_428":414},{"_464":644,"_466":645,"_468":2169,"_470":471,"_412":31,"_472":31,"_41":640,"_473":647,"_475":476,"_419":111,"_90":477},[2170,2171],{"_466":651,"_191":505,"_164":506,"_90":503},{"_466":650,"_191":501,"_164":502,"_90":503},{"_426":2173,"_407":408,"_428":414},{"_483":654,"_457":640,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2175,"_407":408,"_428":414},{"_429":-5,"_445":657,"_41":-5,"_447":2176,"_90":449},[],{"_426":2178,"_407":408,"_428":414},{"_429":2179,"_41":662,"_447":2180,"_90":449},[],[],{"_426":2182,"_407":408,"_428":414},{"_457":666,"_459":667,"_90":461},{"_426":2184,"_407":408,"_428":414},{"_464":-5,"_466":670,"_468":2185,"_470":471,"_412":31,"_472":31,"_41":666,"_473":672,"_475":476,"_419":111,"_90":477},[2186],{"_466":674,"_90":480},{"_426":2188,"_407":408,"_428":414},{"_483":677,"_457":666,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2190,"_407":408,"_428":414},{"_429":-5,"_445":680,"_41":-5,"_447":2191,"_90":449},[],{"_426":2193,"_407":408,"_428":414},{"_429":2194,"_41":685,"_447":2195,"_90":449},[],[],{"_426":2197,"_407":408,"_428":414},{"_457":689,"_459":690,"_90":461},{"_426":2199,"_407":408,"_428":414},{"_464":693,"_466":694,"_468":2200,"_470":471,"_412":31,"_472":31,"_41":689,"_473":696,"_475":476,"_419":111,"_90":477},[2201],{"_466":698,"_90":480},{"_426":2203,"_407":408,"_428":414},{"_483":701,"_457":689,"_41":-5,"_191":485,"_486":-5,"_90":487},{"_426":2205,"_407":408,"_428":414},{"_429":-5,"_445":704,"_41":-5,"_447":2206,"_90":449},[2207],{"_45":707,"_90":541},{"_426":2209,"_407":408,"_428":414},{"_429":2210,"_41":711,"_447":2211,"_90":449},[],[707],{"_426":2213,"_407":408,"_428":414},{"_429":2214,"_41":716,"_90":717},[2215],{"_45":719,"_720":2216,"_90":45},[],{"_426":2218,"_407":408,"_428":414},{"_429":2219,"_431":-5,"_41":-5,"_432":-5,"_94":330,"_90":434},[2220],{"_45":719,"_90":726},{"_426":2222,"_407":408,"_428":414},{"_429":2223,"_431":-5,"_41":-5,"_432":-5,"_94":330,"_90":434},[2224],{"_45":731,"_90":726},{"_426":2226,"_407":408,"_428":414},{"_429":2227,"_431":-5,"_41":-5,"_432":-5,"_94":735,"_90":434},[2228,2229],{"_45":739,"_90":726},{"_45":738,"_90":726},{"_407":408,"_85":2231},{"_101":-5,"_41":414,"_415":2232,"_417":418,"_419":744},[],{"_419":2234,"_407":408},{"_747":2235,"_90":749},[],{"_752":2237},{"_754":-5,"_755":-5,"_756":757,"_758":418,"_470":471,"_759":15,"_760":-5,"_761":-5,"_41":408,"_762":763,"_191":-5,"_164":764,"_765":205,"_475":766,"_419":2238,"_75":2239,"_769":418},{"_90":423},[],[],[2242],{"_41":774,"_775":2243,"_777":778,"_779":778,"_429":2244,"_419":781,"_431":-5,"_782":31,"_783":2245,"_785":304,"_786":-5},{"_94":330,"_191":-5,"_783":2249},{"_791":45,"_792":2248},{"_787":2246},{"_789":2247},[],[794],{},{"_90":434,"_94":91,"_429":2261},{"_90":803,"_804":2252},[2253,2254],{"_164":903,"_809":-5,"_810":2258,"_812":-5},{"_164":808,"_809":-5,"_810":2255,"_812":-5},[2256],{"_814":815,"_816":817,"_429":2257,"_819":57},[820,205,821,822,823,205,824,825,826,827,828,829,830,831,205,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,842,847,848,845,849,850,851,852,853,854,855,852,837,856,205,857,858,859,860,861,862,860,856,205,863,864,865,866,867,868,869,205,870,871,872,873,874,875,876,877,878,879,880,881,882,837,856,205,883,884,872,873,874,875,876,877,878,885,886,887,882,837,856,205,888,871,872,889,874,875,876,878,879,882,837,856,205,890,884,872,889,874,875,876,878,891,882,837,856,205,892,893,894,895,875,876,896,878,879,897,898,899,900,901,882,837,856,902],[2259],{"_814":815,"_816":906,"_429":2260,"_819":57},[820,205,908,909,910,911,822,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,205,929,930,205,931,205,932,933,205,934,935,936,205,937,938,205,939,205,940,941,942,943,944,205,945,946,205,947,948,949,950,205,940,951,952,953,944,954,955,956,957,205,958,205,959,960,961,205,962,963,964,965,966,967,869,968,969,970,869,971,972,973,869,974,975,869,976,977,205,978,979,980,981,982,983,860,984,985,860,986,987,988,989,990,991,992,993,994,995,996,997,869,977,205,998,999,1000,1001,1002,1003,1004,1005,1006,1007,860,869,1008,977,205,1009,1010,205,1011,1012,205,940,1013,1014,1015,1014,1016,1017,1018,1019,1020,1021,1022,1014,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1058,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,944,1080,1081,1082,1083,1084,869,1085,1086,869,205,1087,1088,1089,869,1090,1091,856,1092,205,1093,1094,205,1095,1096,1097,1098,860,1099,1100,1101,1102,1103,837,1104,977,205,1105,1106,1107,1108,1109,1110,1007,1111,1112,1113,1114,1115,852,837,1104,1092,205,1116,1117,1118,1119,1120,1121,869,205,1082,1083,1084,869,205,1122,1123,1124,869,1125,205,1126,205,1127,1128,1129,1130,1131,205,1132,1133,1134,1135,860,984,1136,1137,1138,860,1139,1140,869,205,1141,1142,1143,1144,1145,1104,1146,1147,869,205,1148,1149,1150,1151,1152,205,1153,1154,1155,205,1156,1157,860,869,205,1158,1159,1160,1161,869,205,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,845,1175,852,868,869,205,1176,1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1104,205,1189,1190,1191,1192,1003,1004,1193,1194,1195,1007,1196,860,869,1197,1198,869,205,1199,1200,1201,1202,1203,1204,1205,1206,1207,1208,1209,1210,1211,1212,1213,860,869,205,1214,1215,1216,1217,860,869,205,1218,1219,1220,869,205,1221,1222,205,1223,1224,1225,860,1226,1227,1228,1229,1230,1231,1007,1137,1232,1233,1234,1235,1236,845,1007,860,1237,1238,1239,1240,1241,1007,860,205,1242,1243,1244,1245,1246,1247,1248,1249,1250,1251,1007,860,205,1252,1253,1254,1255,1256,860,1257,1258,1139,1259,1260,1261,1262,1263,1264,1265,1266,1267,1268,1269,1270,1271,1272,1273,1274,1275,1276,205,1277,1278,1279,1280,1281,1276,845,1007,860,869,205,1282,1283,1284,1285,1286,860,205,1287,1288,1289,1290,1007,1291,205,1292,860,869,205,1293,1294,1295,860,869,205,1296,1297,1298,869,205,1299,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1322,1323,1324,1325,868,869,205,1326,1327,1328,1329,1330,860,869,1331,1332,1333,1334,1335,860,869,205,1336,1337,1338,1339,1340,1341,1342,1109,1343,1344,1007,1345,860,205,1346,1347,1348,1349,1350,1351,1352,860,205,1353,1345,860,205,1354,205,1355,1356,1357,205,1097,1358,1359,1360,1361,1007,1362,1363,1364,1365,1366,1367,1368,1369,1370,1371,1372,860,205,1373,1374,1375,1376,1377,1378,1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1272,1392,1274,1276,845,1007,860,205,1393,205,1394,869,205,1395,1354,1396,869,205,1397,1398,1399,1400,860,205,1401,1402,1403,205,864,1404,1405,1406,1407,1408,1409,1410,1411,1100,1412,1413,1414,1415,1416,1417,868,869,205,1418,1419,1420,1421,1422,1423,1424,205,1425,1426,1427,1428,1429,1430,852,860,869,205,1431,1348,1432,1352,860,1433,1434,1435,1436,1437,1438,1439,1440,1441,1442,845,1443,1444,1445,1007,860,1446,869,205,1447,1448,1449,1450,1451,1452,1453,1454,1455,1456,1457,1250,1458,1459,1460,1461,1462,1463,1464,1465,845,1466,1467,1468,1469,1470,1471,1472,1473,1474,1475,1476,1477,1276,1478,1479,1480,1481,845,1482,1483,1484,1485,1486,1487,1488,1489,1007,860,864,1490,1491,868,869,205,1492,1493,1494,1495,860,1139,1496,1497,1498,1499,860,869,205,1500,1501,1502,1503,1504,1505,1007,860,869,205,1506,1507,1508,1509,1510,1511,1512,860,1513,1514,1515,860,205,1516,1517,1518,1519,1520,1521,1522,1523,1276,1524,1525,1526,1527,1528,860,869,205,1529,1530,205,1531,1532,205,1533,205,1534,1535,1536,1537,1538,1399,1539,860,1540,1541,205,1542,1543,1544,1545,1546,1547,1007,1548,1545,1549,1007,205,1550,860,205,1551,1552,1553,1554,837,205,1555,1556,1557,1558,837,205,1559,1560,1561,1562,1563,1564,1565,1566,1567,1563,1568,1569,1563,1570,1571,1572,1573,1543,1544,1545,1546,1547,1007,1548,1545,1574,1575,1576,1547,1007,205,1577,1578,1579,1580,1581,1582,1276,1583,1584,1525,1547,1007,205,1585,1586,1587,1588,1589,1590,1591,1592,1525,1593,1547,1007,205,1594,1595,1596,1597,1598,1599,845,1600,1601,852,1345,860,205,1602,1603,1604,1605,1606,1607,1603,1608,1609,1603,1610,1611,205,1612,205,1613,1614,1615,1616,837,205,1617,1618,1619,1620,1621,1547,1007,1622,205,1623,1624,1625,205,1626,1627,1628,1007,205,1543,1548,1629,1007,1544,1546,1547,1007,205,1630,1631,1632,845,1633,1634,1635,1636,1637,1638,1639,1640,1641,1276,205,1642,1643,1644,1272,1645,1646,1647,1648,1649,1650,1274,1276,845,205,1651,852,860,205,1652,1653,1654,837,1655,1656,837,869,205,1657,1658,1659,1660,1661,1662,869,1663,205,1664,1665,1666,1329,1667,1668,1007,1669,1670,1671,1672,1673,1007,1674,1675,1676,1677,1678,1679,869,205,1680,1681,1682,1334,1683,1684,1674,1675,1676,1685,1678,1686,869,205,1164,1687,1688,1689,1690,1691,1692,1693,860,1694,1695,1696,1697,1698,1699,1700,1701,1007,860,869,205,1702,979,1703,205,1704,1705,1706,1707,1708,1709,1710,1711,1712,845,205,1713,1714,1007,860,205,1715,1716,1717,1718,860,994,1719,869,205,1720,1721,1722,1723,869,205,1724,1725,1726,1345,860,1727,205,1728,1729,1730,1731,1732,860,1733,869,205,1734,1735,1736,1737,837,869,205,1738,1399,1739,1740,860,205,1741,1742,1743,1744,1745,860,205,1746,1747,1748,1749,1750,1751,1752,860,205,1753,1754,1755,860,205,1756,1757,1758,1759,1760,1761,845,1762,1763,845,852,1764,1760,1765,1766,845,205,1767,1768,1769,205,1770,1771,1772,1773,845,1774,852,1345,860,205,1775,1776,1777,1778,1779,860,1780,205,1781,1337,1782,856,205,1783,1784,1785,1786,1787,1678,837,869,205,1788,1789,1790,1345,860,1791,1792,1793,1345,860,1794,205,1795,1796,860,1797,1798,869,1799,1800,1801,1139,1802,1803,837,869,1804,1805,1806,1807,1808,1809,977,205,1810,205,1811,1812,1813,1814,1815,1816,1817,1818,1092,1819,205,1820,1821,977,205,1822,1823,977,205,1824,1825,1826,1827,1104,1828,1829,1830,1137,1831,1832,1833,860,869,979,1834,994,1835,1836,860,1837,1838,1839,1840,1137,1841,860,1842,869,1843,977,205,205,940,1844,1845,1846,1847,944,1848,1849,1850,1851,869,205,1852,1853,205,1854,1855,1856,860,1857,869,205,1858,977,205,1859,1860,977,205,1861,979,1862,994,1863,1864,869,977,205,1865,1866,1867,869,1868,1869,1867,869,1870,1867,869,1871,1872,1873,1874,869,977,205,1875,1876,1877,1878,977],[2262,2263,2264,2265,2266,2267,2268,2269,2270],{"_791":45,"_45":1902},{"_791":1890,"_164":903,"_814":1900,"_816":1901},{"_791":45,"_45":1899},{"_791":1890,"_164":903,"_814":1897,"_816":1898},{"_791":45,"_45":1896},{"_791":1890,"_164":903,"_814":1894,"_816":1895},{"_791":45,"_45":1893},{"_791":1890,"_164":808,"_814":1891,"_816":1892},{"_791":45,"_45":1889},[2273,2274,2275,2276,2277,2278,2279,2280,2281,2282,2283,2284],{"_1912":1913,"_267":202,"_1914":309,"_278":-5,"_1915":261,"_1916":-5,"_1917":1918,"_1919":1920,"_1921":-5,"_1922":-5,"_1923":1924,"_1925":15,"_1926":57,"_1927":52,"_1928":15},{"_90":434,"_94":330,"_429":2285},{"_316":317,"_318":319,"_1956":324,"_1957":127,"_326":-5,"_90":1958},{"_90":1941,"_318":1955,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1954,"_164":903,"_1943":1947,"_1944":-5},{"_90":1941,"_318":1953,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1952,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1951,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1950,"_164":903,"_1943":1947,"_1944":-5},{"_90":1941,"_318":1948,"_164":903,"_1943":1947,"_1944":1949},{"_90":1941,"_318":1946,"_164":903,"_1943":1947,"_1944":-5},{"_90":1941,"_318":1945,"_164":-5,"_1943":-5,"_1944":-5},{"_90":1941,"_318":1942,"_164":-5,"_1943":-5,"_1944":-5},[2286],{"_791":45,"_45":1961},"task_e_6a2d69d4d3788330b984737d1c537ce9",1781361108.826217,"GitHub Mention: fix: do not forward credential headers on cross-origin redirect","has_generated_title","has_unread_turn","denormalized_metadata",{"_2318":31,"_2319":2320,"_2321":-5,"_2322":-5,"_2313":2323,"_2324":-5,"_2325":-5,"_2326":-5,"_2327":-5},"task_status_display",{"_2306":2307,"_2308":202,"_128":125,"_2309":-5,"_2310":2311},"creator_workspace","external_pull_requests",[2299],{"_41":2300,"_2301":81,"_2302":2303,"_2304":127},"github-1753353-813","assistant_turn_id","pull_request",{"_308":309,"_299":310,"_311":312,"_313":15,"_314":57,"_315":15,"_316":317,"_318":319,"_320":321,"_322":125,"_323":324,"_325":127,"_326":327,"_328":-5,"_329":-5,"_330":2305,"_332":333,"_334":335,"_336":337,"_338":339},"codex_updated_sha",{"_293":340,"_191":340,"_341":-5,"_297":342,"_41":343},"latest_turn_status_display",{"_2312":81,"_110":111,"_2313":-5,"_92":2314,"_2315":-5,"_2316":-5,"_2317":2311,"_112":-5},"environment_label","fix_task_id","initial_intent","pr","turn_id","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_2328":-5,"_2329":-5,"_2330":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_2342":2343,"_2344":2345},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","statsigGateEvaluationsPromise",["P",2341],"traceId","5978443271067046004","traceTime",1781419004054]