Route forwards POST data across API redirections
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Description
An API endpoint forwards POST data across redirections from external APIs. When an application follows an HTTP redirect and resends the original POST body to the new destination, sensitive data such as credentials, tokens, or personally identifiable information may be unintentionally leaked to an untrusted third party. This behavior may happen when the server returns a 307 or 308 status code.
Rationale
This finding works by identifying an API route that accepts 307 or 308 redirections from a third party API call.
- Configure HTTP clients to not forward POST bodies across redirections
- Implement explicit redirect handling that validates the target and strips sensitive data before following
- Ensure that sensitive data is only sent to explicitly trusted endpoints
References
