Aleksey Shakhmatov b5259af73e Honor RoundTripper contract in middleware; validate incoming X-Request-Id ...

BearerAuth, BasicAuth and DefaultHeaders mutated the caller's request, which
violates the RoundTripper contract and risks races on shared/retried requests;
clone before writing headers (matching RequestID). Validate the incoming
X-Request-Id (length and character set) before propagating it to logs and the
response header, preventing log forging and header splitting from a
client-controlled value.

2026-05-23 13:47:38 +03:00

1.2 KiB

Raw Blame History

View Raw