Repository navigation
Stop adding Referer headers to installer redirects - #53
Merged
Marc-André Moreau (mamoreau-devolutions) merged 2 commits intoOct 19, 2026
Conversation
… referer behavior
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Marc-André Moreau (mamoreau-devolutions)
approved these changes
Oct 19, 2026
Marc-André Moreau (mamoreau-devolutions)
merged commit Oct 19, 2026
9d384c3
into
Devolutions:master
13 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Disables Reqwest's automatic redirect Referer header for Rust installer downloads, matching .NET's redirect behavior. SourceForge treats requests with that header as browser navigation and can return an HTML landing page instead of redirecting to the installer.
The fix and regression coverage are Rust-only. .NET already behaves correctly and is unchanged.
Regression coverage
download_installer_follows_redirect_and_verifies_final_bytesexercises the Rust core library through a local HTTP server. The redirected endpoint returns HTML if aRefererheader is present; successful download and hash verification therefore require redirects without that header.default_reqwest_redirect_referer_receives_html_instead_of_installerreproduces the failure with Reqwest's default settings against the same local HTTP fixture, showing a successful HTTP response containing HTML rather than the expected installer bytes.download_installer_omits_referer_across_multiple_redirects_and_hostscovers a five-hop 301/302/303/307/308 redirect chain to another server. It checks the original URL is requested without rewriting, the final hash matches, and the original installer filename is preserved.download_installer_rejects_hash_mismatch_after_redirectensures redirected downloads still fail when the final bytes do not match the manifest SHA-256.Related issue
Fixes #50.