Cross Origin - Allow optional protocol upgrade about psr7 HOT 4 CLOSED

I don't think we want to allow upgrade. It is a security mistake to send the confidential data over plain text then get upgraded to https. We also are mimicking how other major projects handle this, such as curl.

from psr7.

So maybe we should have the ability to fully bypass this check too ? In that case the issue is more linked to Guzzle itself, and no more linked to psr7.

from psr7.

I suppose this ability does exist if you implement and use your own redirect middleware without the cross-origin check. I am somewhat hesitant to build this natively into Guzzle, given how edge case this use case is, and how easy it is to use our middleware system to get custom behaviour.

from psr7.

You're right about it, that's in fact an edge case. I'll close the issue and the linked PR.

Thanks 👍

from psr7.