From 6dd49537d05320c0fb6fa0143171a40840271719 Mon Sep 17 00:00:00 2001
From: navnitan-7 <snavnitan@gmail.com>
Date: Mon, 30 Mar 2026 17:29:34 +0530
Subject: [PATCH] Fix CVE-2018-18074: Strip Authorization header on
 HTTPS-to-HTTP redirect

Made-with: Cursor
---
 libs/requests/sessions.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libs/requests/sessions.py b/libs/requests/sessions.py
index 4f30696..4484c7b 100644
--- a/libs/requests/sessions.py
+++ b/libs/requests/sessions.py
@@ -212,7 +212,8 @@ def rebuild_auth(self, prepared_request, response):
             original_parsed = urlparse(response.request.url)
             redirect_parsed = urlparse(url)
 
-            if (original_parsed.hostname != redirect_parsed.hostname):
+            if (original_parsed.hostname != redirect_parsed.hostname) or \
+               (original_parsed.scheme == 'https' and redirect_parsed.scheme != 'https'):
                 del headers['Authorization']
 
         # .netrc might have more auth for us on our new host.