When a relative path redirect is sent in the Location response header and the Authorization header is supplied, Invoke-WebRequest and Invoke-RestMethod will fail to redirect unless the -PreserveAuthorizationOnRedirect parameter is supplied. This does not fail if the Location: supplies an absolute URL.
The problem is here:
|
using (HttpRequestMessage redirectRequest = GetRequest(response.Headers.Location, stripAuthorization:true)) |
We are taking the Location header and supplying it as is. When the Location header contains a relative path (/get for example instead of https://httpbin.org/get), this causes a System.UriFormatException on the following line
|
uri = new Uri("http://" + uri.OriginalString); |
We need to detect an relative URI and construct an absulute one if neccesary.
This is a regression from Windows PowerShell 5.1 introduced in #3885.
Steps to reproduce
$uri = ' https://httpbin.org/relative-redirect/6'
$headers = @{Authorization = "Bearer foo"}
Invoke-WebRequest -Uri $uri -Headers $headers | Select-Object -ExpandProperty ContentExpected behavior
{
"args": {},
"headers": {
"Connection": "close",
"Host": "httpbin.org",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.16299; en-US) PowerShell/6.0.0"
},
"origin": "209.205.125.102",
"url": "https://httpbin.org/get"
}
Actual behavior
Invoke-WebRequest : Invalid URI: The hostname could not be parsed.
At line:1 char:1
+ Invoke-WebRequest -Uri $uri -Headers $headers | Select-Object -Expand ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Invoke-WebRequest], UriFormatException
+ FullyQualifiedErrorId : System.UriFormatException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
Environment data
Name Value
---- -----
PSVersion 6.0.0
PSEdition Core
GitCommitId v6.0.0
OS Microsoft Windows 10.0.16299
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
When a relative path redirect is sent in the
Locationresponse header and theAuthorizationheader is supplied,Invoke-WebRequestandInvoke-RestMethodwill fail to redirect unless the-PreserveAuthorizationOnRedirectparameter is supplied. This does not fail if theLocation:supplies an absolute URL.The problem is here:
PowerShell/src/Microsoft.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs
Line 1214 in beffdcf
We are taking the
Locationheader and supplying it as is. When theLocationheader contains a relative path (/getfor example instead ofhttps://httpbin.org/get), this causes aSystem.UriFormatExceptionon the following linePowerShell/src/Microsoft.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs
Line 661 in beffdcf
We need to detect an relative URI and construct an absulute one if neccesary.
This is a regression from Windows PowerShell 5.1 introduced in #3885.
Steps to reproduce
Expected behavior
Actual behavior
Environment data