mirror of
https://github.com/sbondCo/Watcharr.git
synced 2026-08-07 07:14:44 +00:00
tonghuaroot
4e6e71687b
The Plex integration used bare http.Client values with no CheckRedirect policy, so they followed redirects automatically. net/http strips the standard sensitive headers on a cross-host redirect but not custom-named headers, so the Plex token carried in X-Plex-Token was forwarded verbatim to any host the configured PLEX_HOST redirected to, disclosing the credential. Route all Plex outbound calls through a shared client whose CheckRedirect policy deletes X-Plex-Token when the redirect target host differs from the original request host. Includes a regression test. Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>