Skip to content

pip should not follow redirects from a https:// index url to http:// at any point because doing so dangers users #3174

Description

@dbaxa

When pip is configured to use an extra index at at https:// location it should not follow http:// redirects to download packages or find links (at least not by default). It seems that some pypi servers such as pypicloud (stevearc/pypicloud#60) can in some cases end up redirecting to a http:// location for downloads that pip follows even if the initial index url was https://.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type: securityHas potential security implications

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions