diff --git a/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs b/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs index 479c7ab4908..0c35d456824 100644 --- a/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs +++ b/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs index a2e8173f5f5..f07daf55755 100644 --- a/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs index 132f0a2183a..ca62dd33945 100644 --- a/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs index 48f8260214a..338729594b2 100644 --- a/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs index 3a43c13eadb..22023cd1a72 100644 --- a/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs index c0e4542e698..227ed9e57a9 100644 --- a/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs index 44132ed05ee..a8abe538304 100644 --- a/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs index 4660cdb5e83..670325c2a81 100644 --- a/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs index 26966182276..75f879a9d12 100644 --- a/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs index 32ea11e8ca5..ad9fe660aa0 100644 --- a/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs index 5da28e67974..608733e4f1e 100644 --- a/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs index 1486b11aaad..4cafa96d0ce 100644 --- a/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs index 28fb9fed5d0..4eab0657d94 100644 --- a/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs index bf9e286a0dc..4299b70d184 100644 --- a/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs index 89872147c4a..a4fa1a01c28 100644 --- a/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs index abeafa04353..d4402e5e198 100644 --- a/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs index 471f25795c1..5e06bc85191 100644 --- a/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs index 27f0f0a89cc..9a9a83a21c8 100644 --- a/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs index 125c4a0984c..e800365bb01 100644 --- a/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs index 8c71436d352..2e68e543d60 100644 --- a/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs index f800639cf91..785bcb08369 100644 --- a/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs index 91166d8c68d..e2ea044f46d 100644 --- a/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs index 2a13d743b10..e39f259c3e1 100644 --- a/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs index 1cc9f03dae6..0db4990c706 100644 --- a/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs index 8dba35bb4b8..d5608289132 100644 --- a/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs index b66332d5413..4d1c89d7b61 100644 --- a/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs index 746dd669a96..0230fd6a195 100644 --- a/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs index a91b3bfc716..61e460ef0ee 100644 --- a/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs index cd04fc95ed1..604c7d4652e 100644 --- a/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs index aef1b7e3c6c..896b39c099a 100644 --- a/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs index 6fae9a14aa5..e60aeae5f3f 100644 --- a/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs index 6c5b784e08c..29827d07a3f 100644 --- a/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs index d6d83187425..50c6e938827 100644 --- a/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs index 43a8dc7c47d..275a17dd63e 100644 --- a/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs index 232f6f5628f..4cf04d45aed 100644 --- a/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs index 4f20b0cceea..a7933057e1c 100644 --- a/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs index 8e651737255..267fc8d9d97 100644 --- a/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs index 7df1c8002b2..18c56bae47a 100644 --- a/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs index 36f59ae27d9..52e78208359 100644 --- a/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs index c061fdf797b..32f645f263f 100644 --- a/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs index 87e213ff73f..d2b44630d2e 100644 --- a/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs index 8b85f7c72f2..92d8cc2eaf1 100644 --- a/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs index dd912dc788a..498f22b20a0 100644 --- a/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs index 48aaebc92c3..70b1318f174 100644 --- a/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +390,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } }