[floitsch]

Following an HTTPS-to-HTTP redirect can currently replay a POST body over plaintext. Reject secure-to-plaintext redirects by default in the shared redirect parser, before connecting to the destination or sending its request. A rejected redirect throws INSECURE_REDIRECT.

The policy applies to GET, POST, JSON/form helpers, WebSocket redirects, every redirect hop, and POST-to-GET transitions. Both Client constructors accept --allow-insecure-redirects for explicit opt-in. Explicit HTTP/WS requests and requests that do not follow redirects retain their behavior.

Follow-up to #174: #174 (comment).

Validation on Toit v2.0.0-alpha.199:

• 19/19 local tests passed with ctest --test-dir build -j4 --output-on-failure -E 'google|webdriver', configured with ENABLE_HTTPBIN_TESTS=OFF.
• New regressions cover both constructors, GET/POST/JSON/form/WebSocket requests, 301/302/303/307/308, default rejection, explicit opt-in, disabled redirect following, intermediate hops, and allowed same-origin HTTPS redirects. They assert no connection or bytes reach a rejected destination and verify body replay only when explicitly allowed and the method is retained.
• Tests seed an established secure connection using an in-memory transport; they exercise redirect behavior without a live TLS handshake.
• Removing the downgrade guard makes the new regression fail.
• Source and test analysis and git diff --check passed.

Live Google, browser, and httpbin integration tests were not run locally. This PR targets merged main and can be reviewed independently of the sensitive-header follow-up.

[floitsch]

@CodeRabbit review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ce5c5eff-881d-4f04-ba3f-69e88d9bf2d1

---

📥 Commits

Reviewing files that changed from the base of the PR and between fcad902 and 0331c55.

---

📒 Files selected for processing (2)

• src/client.toit
• tests/client-redirect-downgrade-test.toit

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

Walkthrough

Client adds an allow-insecure-redirects option, defaulting to false. Unless enabled, the client rejects secure-to-insecure redirects with INSECURE_REDIRECT. Tests cover redirect handling across request types, statuses, and client configurations.

Changes

HTTPS Redirect Downgrade Handling

Layer / File(s)	Summary
Configure and enforce redirect policy src/client.toit	Both constructors accept and store allow-insecure-redirects. The redirect-target check throws INSECURE_REDIRECT for secure-to-insecure redirects unless the option is enabled.
Verify redirect behavior tests/client-redirect-downgrade-test.toit	Tests cover redirect statuses, request types, client configurations, redirect chains, and follow settings. Additional tests check explicit HTTP requests and a same-origin HTTPS redirect that retains POST.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 0331c

No identified issue prevents merging after normal checks.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check		The description clearly explains the secure-to-plaintext redirect rejection, opt-in behavior, affected request types, tests, and validation results.
Title check		The title concisely and accurately states the primary change: secure-to-plaintext redirects are rejected by default.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}