Resolve #383 redirect with protocol change

[ath0mas]

Fix #383

[ath0mas]

More results for this spec :

• fail with plugin 3.1.0 and 3.1.1(dev)
• success with 2.5.1, as we expected :) given okhttp setting analysis explained in issue

[silkimen]

Thanks for looking into this issue!

[ath0mas]

My fix is running well with the original tests table and with the spec added here 2 days ago.
Even for me it seems naive or basic so any feedback, change suggestion or contribution would be very welcome!

Should it manage a maximum number of redirections? add a user option like the okhttp followSslRedirects? catch invalid url? match a more reduced set of redirect response codes?
Is that secure enough? given the answers I linked in the parent issue - headers to cleanup? fine for other methods than Get with or without body param? ...etc

[b4rtaz]

When this PR joins to repo?

[silkimen]

Hey guys, sorry for late response.

I think this implementation is very dangerous. As far as I understand, you do not check if the redirect URL requests a HTTPS upgrade (requesting HTTP --> redirected to HTTPS) or a downgrade (requesting HTTPS --> redirected to HTTP).

Downgrades shouldn't be allowed, or at least it should be configurable to prevent that.