Fix for Issue3819 - urllib2 sends Basic auth across redirects

diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py
index 30b7649f2a42aeedb1091cc0656969d010165877..c0366dd18fcc55c2ff4e8e3915e617a0e1fcff3d 100644 (file)
--- a/Lib/test/test_urllib2.py
+++ b/Lib/test/test_urllib2.py
@@ -1134,7 +1134,8 @@ class HandlerTests(unittest.TestCase):
         auth_hdr_value = 'Basic '+base64.encodestring(userpass).strip()
         self.assertEqual(http_handler.requests[1].get_header(auth_header),
                          auth_hdr_value)
-
+        self.assertEqual(http_handler.requests[1].unredirected_hdrs[auth_header],
+                         auth_hdr_value)
         # if the password manager can't find a password, the handler won't
         # handle the HTTP auth error
         password_manager.user = password_manager.password = None

diff --git a/Lib/urllib2.py b/Lib/urllib2.py
index 87ef9fb57a0e1fe2b895828acae3d1e51ed59c6d..122f777ce4a393e12d521ce7b846eb1c78229127 100644 (file)
--- a/Lib/urllib2.py
+++ b/Lib/urllib2.py
@@ -839,7 +839,7 @@ class AbstractBasicAuthHandler:
             auth = 'Basic %s' % base64.b64encode(raw).strip()
             if req.headers.get(self.auth_header, None) == auth:
                 return None
-            req.add_header(self.auth_header, auth)
+            req.add_unredirected_header(self.auth_header, auth)
             return self.parent.open(req, timeout=req.timeout)
         else:
             return None