[Hardik K (hardikkaurani)]

Description

In RedirectHandler._same_origin, origin equivalence was checked solely via:

return (url.scheme == other.scheme and url.host == other.host)

Per RFC 6454 (The Web Origin Concept), the origin tuple consists of (scheme, host, port). When redirecting across different ports on the same host (e.g. https://example.com:443 to https://example.com:8443):

1. _same_origin previously returned True, failing to recognize the cross-origin transition.
2. Because _same_origin returned True, the Host header was not updated (if not self._same_origin(url, request.url): new_request.headers["Host"] = url.netloc.decode("ascii")), leaving a stale Host: example.com rather than Host: example.com:8443.
3. Meanwhile, options.scrub_sensitive_headers correctly checks original_url.port != new_url.port, creating an inconsistency where sensitive headers were scrubbed but the Host header was not updated.

Changes Made

• Updated RedirectHandler._same_origin to include and url.port == other.port.
• Added unit tests:
  • test_not_same_origin_different_port: verifies _same_origin evaluates to False for differing ports.
  • test_redirect_to_different_port_updates_host_header: verifies that redirecting to a different port updates the Host header to include the new port.

cc Vincent Biret (@baywet)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Hardik K (hardikkaurani)]

Hi Vincent Biret (@baywet), submitted this PR to ensure RedirectHandler._same_origin includes port comparison (url.port == other.port), aligning with RFC 6454 and ensuring the Host header is properly refreshed when following redirects to non-default or differing ports. Unit tests included. Ready for review, thank you!

[Vincent Biret (baywet)]

Thanks for the contribution!

[Copilot]

🟢 Approval recommended

The narrow fix addresses the reported behavior with targeted regression coverage and no unresolved findings.

No open issues 🎉

_{Review effort: Balanced}