API Authorization headers are sent in "CDN" download requests

[Przemysław Suliga]

After an authenticated request (eg. using X-Device-Authorization header) to a download endpoint on api.snapcraft.io, snapd follows the redirect and includes the authentication header in the request to the location the API endpoint redirects to.

This is unnecessary. The redirect location, if any, is a signed url to one of our "CDN"s and needs no further authentication.

If the API download endpoint does not return the content right away (which can happen in a snap-store-proxy setting for example) and returns a 302 response, snapd should drop any device/user authentication headers intended for the store API in the request to the redirect location.

(We've (Store) decided that this does not have to be a private bug currently.)

[Samuele Pedroni (pedronis)]

It should be possible to address this with https://pkg.go.dev/net/http#Client.CheckRedirect. Should we drop the authorization headers unconditionally or only if the domain is not the original one?

[Przemysław Suliga (suligap)]

Thanks, it should be fine to drop these headers unconditionally when requesting a download url and receiving a redirect.

[Zeyad Gouda (zeyadgouda)]

Hello, I am currently working on it.

[Zeyad Gouda (zeyadgouda)]

Hello, PR with fix was merged: https://github.com/snapcore/snapd/pull/13055