{"action":"created","comment":{"url":"https://api.github.com/repos/docker/docker/pulls/comments/31488195","id":31488195,"diff_hunk":"@@ -84,7 +84,13 @@ func (tr *authTransport) RoundTrip(orig *http.Request) (*http.Response, error) {\n \tif req.Header.Get(\"Authorization\") == \"\" {\n \t\tif req.Header.Get(\"X-Docker-Token\") == \"true\" && len(tr.Username) > 0 {\n \t\t\treq.SetBasicAuth(tr.Username, tr.Password)\n-\t\t} else if len(tr.token) > 0 {\n+\t\t} else if len(tr.token) > 0 &&\n+\t\t\t// Authorization should not be set on 302 redirect for untrusted locations.\n+\t\t\t// This logic mirrors the behavior in AddRequiredHeadersToRedirectedRequests.\n+\t\t\t// As the authorization logic is currently implemented in RoundTrip,\n+\t\t\t// a 302 redirect is detected by looking at the Referer header as go http package adds said header.\n+\t\t\t// This is safe as Docker doesn't set Referer in other scenarios.\n+\t\t\t(req.Header.Get(\"Referer\") == \"\" || trustedLocation(orig)) {","path":"registry/session.go","position":11,"original_position":11,"commit_id":"65c5105fcca76c34335f689336a663c78786fd9c","original_commit_id":"65c5105fcca76c34335f689336a663c78786fd9c","user":{"login":"jvgogh","id":5240097,"avatar_url":"https://avatars.githubusercontent.com/u/5240097?v=3","gravatar_id":"","url":"https://api.github.com/users/jvgogh","html_url":"https://github.com/jvgogh","followers_url":"https://api.github.com/users/jvgogh/followers","following_url":"https://api.github.com/users/jvgogh/following{/other_user}","gists_url":"https://api.github.com/users/jvgogh/gists{/gist_id}","starred_url":"https://api.github.com/users/jvgogh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvgogh/subscriptions","organizations_url":"https://api.github.com/users/jvgogh/orgs","repos_url":"https://api.github.com/users/jvgogh/repos","events_url":"https://api.github.com/users/jvgogh/events{/privacy}","received_events_url":"https://api.github.com/users/jvgogh/received_events","type":"User","site_admin":false},"body":"Ideally yes, the problem is that the http 302 redirect handling is taken care of by the go http client library (https://golang.org/src/net/http/client.go amusingly enough the function starts on line 302) \r\n\r\nIn registry.go, there is a similar piece of code that is able to use CheckRedirects for this, as the headers are set earlier auth.go. This won't work in session.go without significant refactoring as the header is set in RoundTrip which is called for each http request, including the recursive calls from the go client code resolving the 302 redirects.\r\n\r\nThe only way I found to distinguish in RoundTrip between direct requests and 302 redirect requests is by checking the \"Referer\" header.\r\n\r\nThere might be a way to refactor the code in session.go to deal with this like in registry.go, but that seemed like a larger work item, I'd be happy to discuss, but my first priority was to get 1.7 unbroken for the unauthenticated scenario on custom registries..","created_at":"2015-06-02T02:02:46Z","updated_at":"2015-06-02T02:02:46Z","html_url":"https://github.com/docker/docker/pull/13650#discussion_r31488195","pull_request_url":"https://api.github.com/repos/docker/docker/pulls/13650","_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/comments/31488195"},"html":{"href":"https://github.com/docker/docker/pull/13650#discussion_r31488195"},"pull_request":{"href":"https://api.github.com/repos/docker/docker/pulls/13650"}}},"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/13650","id":36677016,"html_url":"https://github.com/docker/docker/pull/13650","diff_url":"https://github.com/docker/docker/pull/13650.diff","patch_url":"https://github.com/docker/docker/pull/13650.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/13650","number":13650,"state":"open","locked":false,"title":"Upon HTTP 302 redirect do not include \"Authorization\" header on 'untr…","user":{"login":"jvgogh","id":5240097,"avatar_url":"https://avatars.githubusercontent.com/u/5240097?v=3","gravatar_id":"","url":"https://api.github.com/users/jvgogh","html_url":"https://github.com/jvgogh","followers_url":"https://api.github.com/users/jvgogh/followers","following_url":"https://api.github.com/users/jvgogh/following{/other_user}","gists_url":"https://api.github.com/users/jvgogh/gists{/gist_id}","starred_url":"https://api.github.com/users/jvgogh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvgogh/subscriptions","organizations_url":"https://api.github.com/users/jvgogh/orgs","repos_url":"https://api.github.com/users/jvgogh/repos","events_url":"https://api.github.com/users/jvgogh/events{/privacy}","received_events_url":"https://api.github.com/users/jvgogh/received_events","type":"User","site_admin":false},"body":"…usted' registries.\r\n\r\nRefactoring in Docker 1.7 changed the behavior to add this header where as Docker <= 1.6 wouldn't emit this Header on a HTTP 302 redirect.\r\n\r\nThis closes #13649\r\n\r\nSigned-off-by: Jeffrey van Gogh <jvg@google.com>","created_at":"2015-06-01T22:17:18Z","updated_at":"2015-06-02T02:02:46Z","closed_at":null,"merged_at":null,"merge_commit_sha":"14d0266d527148dda3baf01444834f8972662538","assignee":null,"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/38","html_url":"https://github.com/docker/docker/milestones/1.7.0","labels_url":"https://api.github.com/repos/docker/docker/milestones/38/labels","id":1010239,"number":38,"title":"1.7.0","description":"Freeze May 26\r\nRelease  June 16","creator":{"login":"dmcgowan","id":169601,"avatar_url":"https://avatars.githubusercontent.com/u/169601?v=3","gravatar_id":"","url":"https://api.github.com/users/dmcgowan","html_url":"https://github.com/dmcgowan","followers_url":"https://api.github.com/users/dmcgowan/followers","following_url":"https://api.github.com/users/dmcgowan/following{/other_user}","gists_url":"https://api.github.com/users/dmcgowan/gists{/gist_id}","starred_url":"https://api.github.com/users/dmcgowan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmcgowan/subscriptions","organizations_url":"https://api.github.com/users/dmcgowan/orgs","repos_url":"https://api.github.com/users/dmcgowan/repos","events_url":"https://api.github.com/users/dmcgowan/events{/privacy}","received_events_url":"https://api.github.com/users/dmcgowan/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":60,"state":"open","created_at":"2015-03-07T01:54:49Z","updated_at":"2015-06-02T01:09:54Z","due_on":"2016-05-16T07:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/docker/docker/pulls/13650/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/13650/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/13650/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/65c5105fcca76c34335f689336a663c78786fd9c","head":{"label":"jvgogh:master","ref":"master","sha":"65c5105fcca76c34335f689336a663c78786fd9c","user":{"login":"jvgogh","id":5240097,"avatar_url":"https://avatars.githubusercontent.com/u/5240097?v=3","gravatar_id":"","url":"https://api.github.com/users/jvgogh","html_url":"https://github.com/jvgogh","followers_url":"https://api.github.com/users/jvgogh/followers","following_url":"https://api.github.com/users/jvgogh/following{/other_user}","gists_url":"https://api.github.com/users/jvgogh/gists{/gist_id}","starred_url":"https://api.github.com/users/jvgogh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvgogh/subscriptions","organizations_url":"https://api.github.com/users/jvgogh/orgs","repos_url":"https://api.github.com/users/jvgogh/repos","events_url":"https://api.github.com/users/jvgogh/events{/privacy}","received_events_url":"https://api.github.com/users/jvgogh/received_events","type":"User","site_admin":false},"repo":{"id":36690311,"name":"docker","full_name":"jvgogh/docker","owner":{"login":"jvgogh","id":5240097,"avatar_url":"https://avatars.githubusercontent.com/u/5240097?v=3","gravatar_id":"","url":"https://api.github.com/users/jvgogh","html_url":"https://github.com/jvgogh","followers_url":"https://api.github.com/users/jvgogh/followers","following_url":"https://api.github.com/users/jvgogh/following{/other_user}","gists_url":"https://api.github.com/users/jvgogh/gists{/gist_id}","starred_url":"https://api.github.com/users/jvgogh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvgogh/subscriptions","organizations_url":"https://api.github.com/users/jvgogh/orgs","repos_url":"https://api.github.com/users/jvgogh/repos","events_url":"https://api.github.com/users/jvgogh/events{/privacy}","received_events_url":"https://api.github.com/users/jvgogh/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jvgogh/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/jvgogh/docker","forks_url":"https://api.github.com/repos/jvgogh/docker/forks","keys_url":"https://api.github.com/repos/jvgogh/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jvgogh/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jvgogh/docker/teams","hooks_url":"https://api.github.com/repos/jvgogh/docker/hooks","issue_events_url":"https://api.github.com/repos/jvgogh/docker/issues/events{/number}","events_url":"https://api.github.com/repos/jvgogh/docker/events","assignees_url":"https://api.github.com/repos/jvgogh/docker/assignees{/user}","branches_url":"https://api.github.com/repos/jvgogh/docker/branches{/branch}","tags_url":"https://api.github.com/repos/jvgogh/docker/tags","blobs_url":"https://api.github.com/repos/jvgogh/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jvgogh/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jvgogh/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/jvgogh/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jvgogh/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/jvgogh/docker/languages","stargazers_url":"https://api.github.com/repos/jvgogh/docker/stargazers","contributors_url":"https://api.github.com/repos/jvgogh/docker/contributors","subscribers_url":"https://api.github.com/repos/jvgogh/docker/subscribers","subscription_url":"https://api.github.com/repos/jvgogh/docker/subscription","commits_url":"https://api.github.com/repos/jvgogh/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/jvgogh/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/jvgogh/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/jvgogh/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/jvgogh/docker/contents/{+path}","compare_url":"https://api.github.com/repos/jvgogh/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jvgogh/docker/merges","archive_url":"https://api.github.com/repos/jvgogh/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jvgogh/docker/downloads","issues_url":"https://api.github.com/repos/jvgogh/docker/issues{/number}","pulls_url":"https://api.github.com/repos/jvgogh/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/jvgogh/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/jvgogh/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jvgogh/docker/labels{/name}","releases_url":"https://api.github.com/repos/jvgogh/docker/releases{/id}","created_at":"2015-06-01T21:34:31Z","updated_at":"2015-06-01T21:34:38Z","pushed_at":"2015-06-01T23:13:10Z","git_url":"git://github.com/jvgogh/docker.git","ssh_url":"git@github.com:jvgogh/docker.git","clone_url":"https://github.com/jvgogh/docker.git","svn_url":"https://github.com/jvgogh/docker","homepage":"http://www.docker.com","size":222453,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"aa8d8fdc0cfe07ce4e4976dc41a3fdb86ebcfc66","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","created_at":"2013-01-18T18:10:57Z","updated_at":"2015-06-02T00:56:02Z","pushed_at":"2015-06-02T01:45:52Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":222453,"stargazers_count":22063,"watchers_count":22063,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":5247,"mirror_url":null,"open_issues_count":1016,"forks":5247,"open_issues":1016,"watchers":22063,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/13650"},"html":{"href":"https://github.com/docker/docker/pull/13650"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/13650"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/13650/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/13650/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/13650/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/65c5105fcca76c34335f689336a663c78786fd9c"}}}}