GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Limit credentials to the origin host by jshigetomi · Pull Request #28399 · PowerShell/PowerShell

Conversation

@jshigetomi

@jshigetomi Justin Chung (jshigetomi) commented Nov 11, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Collaborator

PR Summary

PR Context

PR Checklist

  • PR has a meaningful title
  • Summarized changes
  • Existing files retain their copyright headers
  • This PR is ready to merge
  • Breaking changes
    • None
  • User-facing changes
    • Not Applicable
  • Testing - New and feature
    • Added tests for the changed behavior

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Patrick Meinecke Justin Chung
Tie credentials to origin host (PowerShell#240)
0cb7411
@jshigetomi
Justin Chung (jshigetomi) requested a review from a team as a code owner November 11, 2026 19:12
Copilot AI balanced review requested due to automatic review settings November 11, 2026 19:12
@azure-pipelines

azure-pipelines Bot commented Nov 11, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Copilot started reviewing on behalf of Justin Chung (jshigetomi) November 11, 2026 19:16
View session
@jshigetomi Justin Chung (jshigetomi) added the CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log label Nov 11, 2026
Copilot AI reviewed Nov 11, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Reused web sessions retain default credentials after UseDefaultCredentials is disabled, while credential-cache handling also causes redirect-authentication and connection-reuse regressions.

3 open issues
  • High severity Disabling default credentials leaves cached authentication active · New
  • Medium severity Redirect preservation does not widen saved credential scope · New
  • Medium severity Recreate authenticated session cache on every request · New
What changed in this PR

This PR hardens credential handling in PowerShell’s web cmdlets by scoping credentials to the request origin unless redirect authorization preservation is enabled.

Changes:

  • Adds origin-scoped credential caches with authentication-scheme handling for explicit and default credentials.
  • Updates shared session preparation to use the new credential handling.
  • Expands both web cmdlets’ tests to check credential lookup across hosts, preservation settings, and URLs without a scheme.
File Description
test/​powershell/​Modules/​Microsoft.PowerShell.Utility/​WebCmdlets.Tests.ps1 Expands credential-scoping tests for both web cmdlets.
src/​Microsoft.PowerShell.Commands.Utility/​commands/​utility/​WebCmdlet/​WebRequestSession.cs Adds origin-scoped credential cache creation.
src/​Microsoft.PowerShell.Commands.Utility/​commands/​utility/​WebCmdlet/​Common/​WebRequestPSCmdlet.Common.cs Routes explicit and default credentials through the new session helper.

Review effort: Balanced

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread ...t.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs
else if (UseDefaultCredentials)
{
WebSession.UseDefaultCredentials = true;
WebSession.SetCredential(CredentialCache.DefaultNetworkCredentials, CheckProtocol(Uri), PreserveAuthorizationOnRedirect);
Comment thread ...t.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs
// Get the relevant NetworkCredential
NetworkCredential netCred = Credential.GetNetworkCredential();
WebSession.Credentials = netCred;
WebSession.SetCredential(Credential.GetNetworkCredential(), CheckProtocol(Uri), PreserveAuthorizationOnRedirect);
Comment thread src/Microsoft.PowerShell.Commands.Utility/commands/utility/WebCmdlet/WebRequestSession.cs
cache.Add(origin, scheme, cred);
}

Credentials = cache;
@jshigetomi Justin Chung (jshigetomi) changed the title Protect credentials by limiting them to the origin host Limit credentials to the origin host Nov 11, 2026
anamnavi
Anam Navied (anamnavi) approved these changes Nov 11, 2026
View reviewed changes
@jshigetomi
Merge branch 'master' into 240bp
e6da01b
@daxian-dbw

Dongbo Wang (daxian-dbw) commented Nov 12, 2026

Copy link
Copy Markdown
Member

Patrick Meinecke (@SeeminglyScience) can you please take a look at the Copilot comments?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
+1 more reviewer
@anamnavi Anam Navied (anamnavi) anamnavi approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@jshigetomi @daxian-dbw @anamnavi
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.