Executive brief
Http4s is a Scala-based HTTP client library widely used to build microservices and API clients. The FollowRedirect middleware, which automatically follows HTTP redirects, fails to strip authentication and session cookies when redirects downgrade from HTTPS to HTTP on the same domain. An attacker who can force a redirect and monitor network traffic can capture these credentials in plaintext, potentially compromising API keys, session tokens, and user accounts.
Technical details
The FollowRedirect middleware in Http4s compares HTTP authority (hostname + port) between pre-redirect and post-redirect URLs to determine whether to strip sensitive headers like Authorization and Cookie. However, the comparison logic excludes the URI scheme (protocol), meaning a same-authority redirect from https://example.com to http://example.com is incorrectly treated as safe. Credentials are preserved and transmitted over plaintext HTTP. The vulnerability requires network-adjacent attacker position to observe traffic (e.g., compromised network, DNS hijacking, or MITM on redirect), or ability to induce the downgrade. Applications using FollowRedirect for any outbound HTTP client calls are affected. Fixes are available in versions 0.23.35 and 1.0.0-M47.
Affected products
- Http4s Http4s prior to 0.23.35 and 1.0.0-M47
Timeline
- 2026-09-15: disclosed
- 2026-07-06: patched: Fix released in versions 0.23.35 and 1.0.0-M47