diff options
| author |   Justin Bronder <jsbronder@cold-front.org> | 2021-12-06 16:24:37 -0500 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-12-08 20:22:47 +0000 |
| commit | a6ab32013a4381a1b694ed46caf2c9da932644d0 (patch) | |
| tree | 9f58d7e916c389b1da9f8974c8a31cd20446d62d /doc | |
| parent | 7e1ca7ab50e3c6b642c3c11504c7c8f52cfa4528 (diff) | |
| download | bitbake-a6ab32013a4381a1b694ed46caf2c9da932644d0.tar.gz | |
fetch2/wget: add redirectauth parameter
Add a parameter that limits sending Basic authentication in the
Authorization header to only the first host and not any that we're
redirected to. Ignoring potential security concerns, temporary AWS URLs
will reject any request that includes authentication details in both the
query parameters (from the redirect) and in the Authorization header.
Temporary AWS URLs are now being used for release assets from private
Github repositories. According to the previous discussion linked below,
they're also in use by bitbucket.
See also:
https://lore.kernel.org/bitbake-devel/CAC9ffDEuZL-k8199bUyN+8frjw6bg-g=vrumxxtvt+RVParQ8Q@mail.gmail.com/
Signed-off-by: Justin Bronder <jsbronder@cold-front.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/bitbake-user-manual/bitbake-user-manual-fetching.rst | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/doc/bitbake-user-manual/bitbake-user-manual-fetching.rst b/doc/bitbake-user-manual/bitbake-user-manual-fetching.rst index 51ab233ad..0fc2d5e69 100644 --- a/doc/bitbake-user-manual/bitbake-user-manual-fetching.rst +++ b/doc/bitbake-user-manual/bitbake-user-manual-fetching.rst @@ -229,6 +229,11 @@ downloaded file is useful for avoiding collisions in :term:`DL_DIR` when dealing with multiple files that have the same name. +If a username and password are specified in the ``SRC_URI``, a Basic +Authorization header will be added to each request, including across redirects. +To instead limit the Authorization header to the first request, add +"redirectauth=0" to the list of parameters. + Some example URLs are as follows:: SRC_URI = "http://oe.handhelds.org/not_there.aac" |