# Redirect credential leak via weak origin check

Credential-bearing requests follow redirects where same-origin check compares only hostname, not scheme and port

_Area: Web infrastructure and server-side requests. Seen in 4 disclosed reports; 4 confirmed bounties, median $590, range $250-$2,400; latest 2026-04-13. Updated 2026-10-23._

## How it works
Code that follows redirects or fetches server-supplied URLs decides whether to attach credentials by checking "same host." That check is incomplete: it compares hostnames but ignores scheme and port, or it validates a URL with a substring match instead of parsing it. The assumption that "same hostname means same trust boundary" breaks. A redirect to the same host on a different port, or from HTTPS to FTP/HTTP, is treated as trusted and the Authorization header, Cookie, or Basic Auth password is sent to whoever controls that endpoint [E1](https://bugbountylibrary.com/r/h1%3A1551586.md)[E5](https://bugbountylibrary.com/r/h1%3A1551591.md). The same trust-boundary failure appears when a client injects credentials into any server-supplied URL by default [E2](https://bugbountylibrary.com/r/h1%3A3400143.md), or when a URL is accepted because it merely contains an expected substring [E3](https://bugbountylibrary.com/r/h1%3A1067809.md).

## Where it shows up
- Redirect-following HTTP clients (curl, REST libraries) with a hostname-only same-origin comparison [E1](https://bugbountylibrary.com/r/h1%3A1551586.md)[E5](https://bugbountylibrary.com/r/h1%3A1551591.md)
- Credential managers that attach auth headers by default, with an opt-out flag the code path never sets [E2](https://bugbountylibrary.com/r/h1%3A3400143.md)
- URL validation using `contains()`/substring or regex instead of full origin parsing [E3](https://bugbountylibrary.com/r/h1%3A1067809.md)
- Server-supplied download/redirect/CDN URLs trusted without origin checks [E2](https://bugbountylibrary.com/r/h1%3A3400143.md)

## How to review
Find every place credentials (Authorization, Cookie, Basic Auth) are attached to an outbound request, and every redirect-following path. The invariant: credentials must only be sent when scheme, host, and port all match the original origin, and only to URLs whose origin was parsed and fully validated. Check that the same-origin comparison tests all three dimensions independently, that server-supplied URLs are parsed (not substring-matched) and origin-checked before auth injection [E3](https://bugbountylibrary.com/r/h1%3A1067809.md), and that the credential opt-out is set on every code path. Test protocol downgrade, port change, and host change separately [E1](https://bugbountylibrary.com/r/h1%3A1551586.md)[E5](https://bugbountylibrary.com/r/h1%3A1551591.md).

## Variants seen
- Hostname-only check leaks password on HTTPS-to-FTP redirect [E1](https://bugbountylibrary.com/r/h1%3A1551586.md)
- Same host, different port/scheme retains Authorization and Cookie [E5](https://bugbountylibrary.com/r/h1%3A1551591.md)
- Client auto-injects Basic Auth into unvalidated directDownloadUrl [E2](https://bugbountylibrary.com/r/h1%3A3400143.md)
- Substring `contains()` validation of a URL cookie [E3](https://bugbountylibrary.com/r/h1%3A1067809.md)

## Why fixes fail
Fixes that only add a hostname comparison still leak on port or scheme change [E1](https://bugbountylibrary.com/r/h1%3A1551586.md)[E5](https://bugbountylibrary.com/r/h1%3A1551591.md); the opt-out attribute must be set on every code path, not just one [E2](https://bugbountylibrary.com/r/h1%3A3400143.md).

## Impact and severity
Plaintext credential and session-token disclosure to attacker-controlled hosts, ranging from user passwords [E1](https://bugbountylibrary.com/r/h1%3A1551586.md) to auth/cookie headers [E5](https://bugbountylibrary.com/r/h1%3A1551591.md) to Basic Auth [E2](https://bugbountylibrary.com/r/h1%3A3400143.md). Worse when the leaked secret is a long-lived password, or when the redirect target or server-supplied URL is attacker-influenced [E1](https://bugbountylibrary.com/r/h1%3A1551586.md)[E2](https://bugbountylibrary.com/r/h1%3A3400143.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1551586.md
- E2: https://bugbountylibrary.com/r/h1%3A3400143.md
- E3: https://bugbountylibrary.com/r/h1%3A1067809.md
- E4: https://bugbountylibrary.com/r/h1%3A1089995.md
- E5: https://bugbountylibrary.com/r/h1%3A1551591.md