From a248ae28388be61bf17ec6d8f7ce886f7fe5dc0f Mon Sep 17 00:00:00 2001 From: Yang An Date: Wed, 5 Aug 2026 11:33:14 +1000 Subject: [PATCH 1/5] Strip credentials from cross-origin request clones --- .../runtime/csharp/pipeline/ISendAsync.cs | 9 +++++++ powershell/test/runtime-header-forwarding.ts | 24 +++++++++++++++++++ 2 files changed, 33 insertions(+) create mode 100644 powershell/test/runtime-header-forwarding.ts diff --git a/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs b/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs index 479c7ab4908..740173b4217 100644 --- a/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs +++ b/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs @@ -356,6 +356,11 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +381,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/powershell/test/runtime-header-forwarding.ts b/powershell/test/runtime-header-forwarding.ts new file mode 100644 index 00000000000..6fdaa62ee83 --- /dev/null +++ b/powershell/test/runtime-header-forwarding.ts @@ -0,0 +1,24 @@ +/*--------------------------------------------------------------------------------------------- + * Copyright (c) Microsoft Corporation. All rights reserved. + * Licensed under the MIT License. See License.txt in the project root for license information. + *--------------------------------------------------------------------------------------------*/ + +import * as assert from 'assert'; +import * as fs from 'fs'; +import * as path from 'path'; +import { suite, test } from '@testdeck/mocha'; + +@suite class RuntimeHeaderForwarding { + + @test 'Credentials are not forwarded across origins'() { + const runtimePath = path.resolve(__dirname, '../../resources/runtime/csharp/pipeline/ISendAsync.cs'); + const runtime = fs.readFileSync(runtimePath, 'utf8'); + + assert.match(runtime, /original\.RequestUri\.Scheme\.Equals\(requestUri\.Scheme/); + assert.match(runtime, /original\.RequestUri\.Host\.Equals\(requestUri\.Host/); + assert.match(runtime, /original\.RequestUri\.Port == requestUri\.Port/); + assert.match(runtime, /!isSameOrigin && \("Authorization"\.Equals/); + assert.match(runtime, /"Proxy-Authorization"\.Equals/); + assert.match(runtime, /"Cookie"\.Equals/); + } +} \ No newline at end of file From 82e5d63a8e4074487b5e840d3de3373a07027b7c Mon Sep 17 00:00:00 2001 From: Yang An Date: Wed, 5 Aug 2026 11:57:04 +1000 Subject: [PATCH 2/5] Require https same-origin before forwarding credentials on request clone --- powershell/resources/runtime/csharp/pipeline/ISendAsync.cs | 3 ++- powershell/test/runtime-header-forwarding.ts | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs b/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs index 740173b4217..543a22e19ec 100644 --- a/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs +++ b/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs @@ -360,7 +360,8 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port); + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/powershell/test/runtime-header-forwarding.ts b/powershell/test/runtime-header-forwarding.ts index 6fdaa62ee83..f970e78ec6f 100644 --- a/powershell/test/runtime-header-forwarding.ts +++ b/powershell/test/runtime-header-forwarding.ts @@ -17,6 +17,7 @@ import { suite, test } from '@testdeck/mocha'; assert.match(runtime, /original\.RequestUri\.Scheme\.Equals\(requestUri\.Scheme/); assert.match(runtime, /original\.RequestUri\.Host\.Equals\(requestUri\.Host/); assert.match(runtime, /original\.RequestUri\.Port == requestUri\.Port/); + assert.match(runtime, /requestUri\.Scheme\.Equals\(System\.Uri\.UriSchemeHttps/); assert.match(runtime, /!isSameOrigin && \("Authorization"\.Equals/); assert.match(runtime, /"Proxy-Authorization"\.Equals/); assert.match(runtime, /"Cookie"\.Equals/); From e75a7d4c0d015241bf557e0e44eab33957405e41 Mon Sep 17 00:00:00 2001 From: Yang An Date: Wed, 5 Aug 2026 12:48:05 +1000 Subject: [PATCH 3/5] Update emitter test baselines for cross-origin credential strip --- .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ .../target/generated/runtime/ISendAsync.cs | 10 ++++++++++ 43 files changed, 430 insertions(+) diff --git a/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs index a2e8173f5f5..98e68a0fe5d 100644 --- a/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs index 132f0a2183a..492c7a4769d 100644 --- a/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs index 48f8260214a..e7b69e1a714 100644 --- a/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs index 3a43c13eadb..76c71142ebc 100644 --- a/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs index c0e4542e698..a86f963957d 100644 --- a/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs index 44132ed05ee..22f10ceabeb 100644 --- a/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs index 4660cdb5e83..950d890eb80 100644 --- a/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs index 26966182276..fb7691e0380 100644 --- a/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs index 32ea11e8ca5..dc630d6ca43 100644 --- a/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs index 5da28e67974..8537fae9c0f 100644 --- a/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs index 1486b11aaad..dd5f2757b0b 100644 --- a/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs index 28fb9fed5d0..bcce40b0708 100644 --- a/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs index bf9e286a0dc..db62b2e4bb9 100644 --- a/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs index 89872147c4a..755c753c676 100644 --- a/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs index abeafa04353..521f8f9dd2b 100644 --- a/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs index 471f25795c1..673859cbb68 100644 --- a/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs index 27f0f0a89cc..d5099ee97d1 100644 --- a/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs index 125c4a0984c..58bfa88f93e 100644 --- a/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs index 8c71436d352..258f2babcfd 100644 --- a/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs index f800639cf91..9728a4e89d6 100644 --- a/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs index 91166d8c68d..56cd5cd94c2 100644 --- a/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs index 2a13d743b10..f13cd271629 100644 --- a/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs index 1cc9f03dae6..6ef2b80578d 100644 --- a/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs index 8dba35bb4b8..ba775242bcd 100644 --- a/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs index b66332d5413..c440bd07280 100644 --- a/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs index 746dd669a96..11237fa4efc 100644 --- a/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs index a91b3bfc716..41ebb36aa33 100644 --- a/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs index cd04fc95ed1..a8a33879814 100644 --- a/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs index aef1b7e3c6c..ec1f2c721a1 100644 --- a/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs index 6fae9a14aa5..b3309c8f807 100644 --- a/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs index 6c5b784e08c..6fd3b8fbb72 100644 --- a/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs index d6d83187425..d2ed647028a 100644 --- a/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs index 43a8dc7c47d..5fd710786d0 100644 --- a/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs index 232f6f5628f..57b9b738ea5 100644 --- a/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs index 4f20b0cceea..fa41a8e0af7 100644 --- a/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs index 8e651737255..b069e7513e5 100644 --- a/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs index 7df1c8002b2..f0888f33355 100644 --- a/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs index 36f59ae27d9..c1434a7eaeb 100644 --- a/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs index c061fdf797b..89c1dcdaf80 100644 --- a/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs index 87e213ff73f..56e9779bbbb 100644 --- a/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs index 8b85f7c72f2..b4dd36d3233 100644 --- a/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs index dd912dc788a..a9c1687f6b6 100644 --- a/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } diff --git a/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs index 48aaebc92c3..a7a41f9caa7 100644 --- a/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs @@ -356,6 +356,12 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { + var isSameOrigin = requestUri == null || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == requestUri.Port && + requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, @@ -376,6 +382,10 @@ internal static HttpRequestMessage Clone(this HttpRequestMessage original, Syste */ if (!"x-ms-unique-id".Equals(header.Key) && !"x-ms-client-request-id".Equals(header.Key) && !"CommandName".Equals(header.Key) && !"FullCommandName".Equals(header.Key) && !"ParameterSetName".Equals(header.Key) && !"User-Agent".Equals(header.Key)) { + if (!isSameOrigin && ("Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Proxy-Authorization".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase) || "Cookie".Equals(header.Key, System.StringComparison.OrdinalIgnoreCase))) + { + continue; + } clone.Headers.TryAddWithoutValidation(header.Key, header.Value); } } From 441e95ebefc5977f34145b7b0d49562d3bf73d86 Mon Sep 17 00:00:00 2001 From: Yang An Date: Thu, 6 Aug 2026 17:42:23 +1000 Subject: [PATCH 4/5] Remove runtime-header-forwarding guard test (redundant with emitter baselines) --- powershell/test/runtime-header-forwarding.ts | 25 -------------------- 1 file changed, 25 deletions(-) delete mode 100644 powershell/test/runtime-header-forwarding.ts diff --git a/powershell/test/runtime-header-forwarding.ts b/powershell/test/runtime-header-forwarding.ts deleted file mode 100644 index f970e78ec6f..00000000000 --- a/powershell/test/runtime-header-forwarding.ts +++ /dev/null @@ -1,25 +0,0 @@ -/*--------------------------------------------------------------------------------------------- - * Copyright (c) Microsoft Corporation. All rights reserved. - * Licensed under the MIT License. See License.txt in the project root for license information. - *--------------------------------------------------------------------------------------------*/ - -import * as assert from 'assert'; -import * as fs from 'fs'; -import * as path from 'path'; -import { suite, test } from '@testdeck/mocha'; - -@suite class RuntimeHeaderForwarding { - - @test 'Credentials are not forwarded across origins'() { - const runtimePath = path.resolve(__dirname, '../../resources/runtime/csharp/pipeline/ISendAsync.cs'); - const runtime = fs.readFileSync(runtimePath, 'utf8'); - - assert.match(runtime, /original\.RequestUri\.Scheme\.Equals\(requestUri\.Scheme/); - assert.match(runtime, /original\.RequestUri\.Host\.Equals\(requestUri\.Host/); - assert.match(runtime, /original\.RequestUri\.Port == requestUri\.Port/); - assert.match(runtime, /requestUri\.Scheme\.Equals\(System\.Uri\.UriSchemeHttps/); - assert.match(runtime, /!isSameOrigin && \("Authorization"\.Equals/); - assert.match(runtime, /"Proxy-Authorization"\.Equals/); - assert.match(runtime, /"Cookie"\.Equals/); - } -} \ No newline at end of file From a87ff9c8156b35f0fdf2963808ea17f2c387588c Mon Sep 17 00:00:00 2001 From: Yang An Date: Fri, 7 Aug 2026 09:48:39 +1000 Subject: [PATCH 5/5] Resolve relative nextLinks before same-origin check; strip only on resolved cross-origin/non-https targets Addresses review feedback: relative same-origin nextLinks were misclassified as cross-origin (creds stripped); now resolve the target against the original request and compare the effective absolute origin. Null target (retry/same request) keeps headers. Runtime + 43 emitter baselines. --- .../runtime/csharp/pipeline/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ .../target/generated/runtime/ISendAsync.cs | 20 +++++++++++++------ 44 files changed, 616 insertions(+), 264 deletions(-) diff --git a/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs b/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs index 543a22e19ec..0c35d456824 100644 --- a/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs +++ b/powershell/resources/runtime/csharp/pipeline/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs index 98e68a0fe5d..f07daf55755 100644 --- a/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AppComplianceAutomation.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs index 492c7a4769d..ca62dd33945 100644 --- a/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Astronomer.Astro.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs index e7b69e1a714..338729594b2 100644 --- a/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureAI.Assets/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs index 76c71142ebc..22023cd1a72 100644 --- a/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureFleet.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs index a86f963957d..227ed9e57a9 100644 --- a/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/AzureLargeInstance.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs index 22f10ceabeb..a8abe538304 100644 --- a/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Chaos.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs index 950d890eb80..670325c2a81 100644 --- a/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/CodeSigning.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs index fb7691e0380..75f879a9d12 100644 --- a/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ComputeSchedule.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs index dc630d6ca43..ad9fe660aa0 100644 --- a/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Dashboard.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs index 8537fae9c0f..608733e4f1e 100644 --- a/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataBox.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs index dd5f2757b0b..4cafa96d0ce 100644 --- a/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataProtection.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs index bcce40b0708..4eab0657d94 100644 --- a/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DataReplication.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs index db62b2e4bb9..4299b70d184 100644 --- a/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DeviceProvisioningServices.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs index 755c753c676..a4fa1a01c28 100644 --- a/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DeviceRegistry.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs index 521f8f9dd2b..d4402e5e198 100644 --- a/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/DocumentDB.MongoCluster.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs index 673859cbb68..5e06bc85191 100644 --- a/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/EdgeZones.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs index d5099ee97d1..9a9a83a21c8 100644 --- a/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ElasticSan.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs index 58bfa88f93e..e800365bb01 100644 --- a/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Fleet.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs index 258f2babcfd..2e68e543d60 100644 --- a/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HardwareSecurityModules.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs index 9728a4e89d6..785bcb08369 100644 --- a/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HealthDataAIServices.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs index 56cd5cd94c2..e2ea044f46d 100644 --- a/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Help.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs index f13cd271629..e39f259c3e1 100644 --- a/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/HybridKubernetes.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs index 6ef2b80578d..0db4990c706 100644 --- a/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Informatica.DataManagement.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs index ba775242bcd..d5608289132 100644 --- a/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/KeyVault.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs index c440bd07280..4d1c89d7b61 100644 --- a/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/KubernetesRuntime.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs index 11237fa4efc..0230fd6a195 100644 --- a/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/LambdaTest.HyperExecute.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs index 41ebb36aa33..61e460ef0ee 100644 --- a/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Liftr.WeightsAndBiases.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs index a8a33879814..604c7d4652e 100644 --- a/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.AVS.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs index ec1f2c721a1..896b39c099a 100644 --- a/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.DBforMySQL.FlexibleServers.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs index b3309c8f807..e60aeae5f3f 100644 --- a/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.DevOpsInfrastructure.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs index 6fd3b8fbb72..29827d07a3f 100644 --- a/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Microsoft.RecoveryServices.RecoveryServicesBackup.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs index d2ed647028a..50c6e938827 100644 --- a/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Neon.Postgres.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs index 5fd710786d0..275a17dd63e 100644 --- a/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/NetworkAnalytics.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs index 57b9b738ea5..4cf04d45aed 100644 --- a/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Oracle.Database.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs index fa41a8e0af7..a7933057e1c 100644 --- a/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Pinecone.VectorDb.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs index b069e7513e5..267fc8d9d97 100644 --- a/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Qumulo.Storage.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs index f0888f33355..18c56bae47a 100644 --- a/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/RecoveryServices.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs index c1434a7eaeb..52e78208359 100644 --- a/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/ServiceFabricManagedClusters.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs index 89c1dcdaf80..32f645f263f 100644 --- a/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Sphere.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs index 56e9779bbbb..d2b44630d2e 100644 --- a/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StandbyPool.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs index b4dd36d3233..92d8cc2eaf1 100644 --- a/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StorageAction.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs index a9c1687f6b6..498f22b20a0 100644 --- a/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/StorageMover.Management.brown/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method, diff --git a/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs b/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs index a7a41f9caa7..70b1318f174 100644 --- a/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs +++ b/tests-upgrade/tests-emitter/Workloads.SAPVirtualInstance.Management/target/generated/runtime/ISendAsync.cs @@ -356,12 +356,20 @@ internal static Task CloneWithContentAndDispose(this HttpReq /// A clone of the HttpRequestMessage internal static HttpRequestMessage Clone(this HttpRequestMessage original, System.Uri requestUri = null, System.Net.Http.HttpMethod method = null) { - var isSameOrigin = requestUri == null || - (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && requestUri.IsAbsoluteUri && - original.RequestUri.Scheme.Equals(requestUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Host.Equals(requestUri.Host, System.StringComparison.OrdinalIgnoreCase) && - original.RequestUri.Port == requestUri.Port && - requestUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); + // Resolve a relative target against the original request so same-origin relative nextLinks are not misclassified as cross-origin. + var effectiveTargetUri = requestUri; + if (effectiveTargetUri != null && !effectiveTargetUri.IsAbsoluteUri && original.RequestUri != null && original.RequestUri.IsAbsoluteUri) + { + System.Uri.TryCreate(original.RequestUri, effectiveTargetUri, out effectiveTargetUri); + } + // Keep credentials only for a same-origin (scheme+host+port) https target. A null target (no retarget, e.g. retry) + // or an unresolved relative target preserves existing behavior and keeps the headers. + var isSameOrigin = effectiveTargetUri == null || !effectiveTargetUri.IsAbsoluteUri || + (original.RequestUri != null && original.RequestUri.IsAbsoluteUri && + original.RequestUri.Scheme.Equals(effectiveTargetUri.Scheme, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Host.Equals(effectiveTargetUri.Host, System.StringComparison.OrdinalIgnoreCase) && + original.RequestUri.Port == effectiveTargetUri.Port && + effectiveTargetUri.Scheme.Equals(System.Uri.UriSchemeHttps, System.StringComparison.OrdinalIgnoreCase)); var clone = new HttpRequestMessage { Method = method ?? original.Method,