<p dir="auto">In <code class="notranslate">requests/requests-kerberos</code> we use GSSAPI to not only authenticate to the server, but also authenticate the server as well. It's called mutual authentication. The way that <code class="notranslate">Session.send</code> resolves redirects doesn't allow us to authenticate the redirects.</p>
<p dir="auto">This is a problem because if a user sends a request to <code class="notranslate">host_a</code> which redirects us to <code class="notranslate">host_b</code> and we authenticate <code class="notranslate">host_b</code> successfully, that really doesn't mean anything to the user if he can't actually trust that the process which issued the redirect was actually <code class="notranslate">host_a</code>.</p>
<p dir="auto">This means that if we want to require mutual authentication, we cannot follow redirects at all, even if the servers are capable of authenticating their redirects.</p>
<p dir="auto">Would it be possible to either:</p>
<ol dir="auto">
<li>Dispatch the <code class="notranslate">response</code> hook on redirects</li>
<li>Create a new kind of hook which authentication mechanisms can install specifically for handling redirects?</li>
</ol>
<p dir="auto">I see problems with option 1. If we'd be amenable to option 2, I'll work on a pull request for it. Unless someone says otherwise I'd call the hook <code class="notranslate">redirect</code>.</p>
<p dir="auto">The last release of requests was from June 29.</p>
<p dir="auto">Since then charset-normalizer 3.x has been released, which the release is incompatible with. This was already fixed in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1416344534" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6261" data-hovercard-type="pull_request" data-hovercard-url="/psf/requests/pull/6261/hovercard" href="https://github.com/psf/requests/pull/6261">#6261</a>, but is unreleased.</p>
<p dir="auto">Clearly this affects many people, as this issue has been re-reported <strong>so</strong> many times:</p>
<ul dir="auto">
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1423303078" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6268" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/6268/hovercard" href="https://github.com/psf/requests/issues/6268">#6268</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1425605764" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6272" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/6272/hovercard" href="https://github.com/psf/requests/issues/6272">#6272</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1467868113" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6298" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/6298/hovercard" href="https://github.com/psf/requests/issues/6298">#6298</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1455004967" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6288" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/6288/hovercard" href="https://github.com/psf/requests/issues/6288">#6288</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1493511210" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6305" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/6305/hovercard" href="https://github.com/psf/requests/issues/6305">#6305</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1442281749" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6281" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/6281/hovercard" href="https://github.com/psf/requests/issues/6281">#6281</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1430345158" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6273" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/6273/hovercard" href="https://github.com/psf/requests/issues/6273">#6273</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1425605764" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/6272" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/6272/hovercard" href="https://github.com/psf/requests/issues/6272">#6272</a></li>
</ul>
<p dir="auto">If even just to stop people from wasting their time re-reporting this, please make a release.</p>