Repository navigation
_blob endpoint redirects in CrateDB loose Basic HTTP Auth headers #800
Description
With: crate/crate@c8a0dcc fix for _blobs authorization, it's required for blob actions to make sure that Basic HTTP Auth headers are set, even if CrateDB redirects the http request to a different node (the one that holds the shard of the blob table, for performance purposes. By default http clients drop the Basic HTTP Auth headers in the case of a redirect (for security reasons). Please check the relevant issue: crate/crate#19335
Metadata
Metadata
Assignees
Labels
No labels
Activity
bgunebakan commentedon May 13, 2026
Hi @matriv,
Thanks for detailed information and report.
The client actually handles this correctly already.
Server.request()setsredirect=Falseon urllib3, so redirects are never followed automatically.Client._request()detects 3xx responses manually and re-issues the request by recursively calling itself with the redirect target as the server while rebuilding the Authorization header.There is a gap on unitests. Current tests do not cover this feature. I will introduce new tests to cover Auth handling on redirects.
Best,
Bilal
matriv commentedon May 13, 2026
Thanks for investigating, and yes, adding test would be great!