[pfefferle]

Fixes #

Proposed changes:

• Both signers signed the host without the port: Draft Cavage as host, RFC 9421 as @authority. WordPress sends Host with the port whenever it is not the scheme's default (cURL and fsockopen both do), so a server on a non-default port could not verify our signatures. RFC 9421 @target-uri already had the port.
• New get_authority( $url ) returns the host plus the port when it is not 80/443 for http/https, the way RFC 9110 defines Host. Both signers use it.

Other information:

• Have you written new tests for your changes, if applicable?

Requests on the default ports are unchanged, the port is only added when the URL has a non-default one. I did not set Host explicitly in sign(), because Requests would then send the same Host along on redirects to another host.

Testing instructions:

• vendor/bin/phpunit --filter 'test_get_authority|test_sign_names_a_non_default_port'
• Both formats (Draft Cavage and RFC 9421) sign for example.org:8443 and verify with that Host. Without the change both fail.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message