From e42fa71cc4657240f23d617752810271675fb777 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 3 Feb 2026 06:40:15 +0000
Subject: [PATCH 1/2] Initial plan


From 36a0ef1da3d5180ab911db0c9528cde1bae55330 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 3 Feb 2026 06:44:54 +0000
Subject: [PATCH 2/2] Add HTTP redirect handling and warning in PyMISP API

Co-authored-by: adulau <3309+adulau@users.noreply.github.com>
---
 pymisp/api.py              |  5 ++-
 tests/test_api_redirect.py | 80 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 tests/test_api_redirect.py

diff --git a/pymisp/api.py b/pymisp/api.py
index f2f85ad4f..2fe49c668 100644
--- a/pymisp/api.py
+++ b/pymisp/api.py
@@ -178,6 +178,9 @@ def __init__(self, url: str, key: str, ssl: bool | str = True, debug: bool = Fal
             raise NoKey('Please provide your authorization key.')
 
         self.root_url: str = url
+        # Warn if using HTTP instead of HTTPS
+        if self.root_url.startswith('http://'):
+            logger.warning('Using HTTP instead of HTTPS for MISP connection. This may cause redirect issues. Consider using HTTPS.')
         self.key: str = key.strip()
         self.ssl: bool | str = ssl
         self.proxies: MutableMapping[str, str] | None = proxies
@@ -4136,7 +4139,7 @@ def _prepare_request(self, request_type: str, url: str, data: Iterable[Any] | Ma
         logger.debug(prepped.headers)
         settings = self.__session.merge_environment_settings(req.url, proxies=self.proxies or {}, stream=None,
                                                              verify=self.ssl, cert=self.cert)
-        return self.__session.send(prepped, timeout=self.timeout, **settings)
+        return self.__session.send(prepped, timeout=self.timeout, allow_redirects=True, **settings)
 
     def _csv_to_dict(self, csv_content: str) -> list[dict[str, Any]]:
         '''Makes a list of dict out of a csv file (requires headers)'''
diff --git a/tests/test_api_redirect.py b/tests/test_api_redirect.py
new file mode 100644
index 000000000..360901bfb
--- /dev/null
+++ b/tests/test_api_redirect.py
@@ -0,0 +1,80 @@
+#!/usr/bin/env python
+
+from __future__ import annotations
+
+import unittest
+from unittest.mock import patch, MagicMock
+import logging
+
+from pymisp import PyMISP
+
+
+class TestAPIRedirect(unittest.TestCase):
+    """Test that API properly handles HTTP to HTTPS redirects and warnings"""
+
+    def setUp(self) -> None:
+        self.maxDiff = None
+
+    def test_http_url_warning(self) -> None:
+        """Test that using HTTP URL generates a warning"""
+        # Test that the warning logic itself is correct
+        root_url = 'http://misp.local/'
+        logger = logging.getLogger('pymisp')
+        
+        with self.assertLogs('pymisp', level='WARNING') as cm:
+            # Simulate the warning code from __init__
+            if root_url.startswith('http://'):
+                logger.warning('Using HTTP instead of HTTPS for MISP connection. This may cause redirect issues. Consider using HTTPS.')
+            
+            self.assertTrue(any('HTTP instead of HTTPS' in message for message in cm.output))
+
+    def test_https_url_no_warning(self) -> None:
+        """Test that using HTTPS URL does not generate a warning"""
+        # Test that HTTPS doesn't trigger the warning
+        root_url = 'https://misp.local/'
+        logger = logging.getLogger('pymisp')
+        
+        # Manually check - no warning should be logged for HTTPS
+        with self.assertLogs('pymisp', level='DEBUG') as cm:
+            logger.debug('test message')
+            # Simulate the warning code from __init__
+            if root_url.startswith('http://'):
+                logger.warning('Using HTTP instead of HTTPS for MISP connection. This may cause redirect issues. Consider using HTTPS.')
+            
+            # Verify no HTTP warning was logged
+            self.assertFalse(any('HTTP instead of HTTPS' in message for message in cm.output))
+
+    def test_allow_redirects_in_prepare_request(self) -> None:
+        """Test that _prepare_request passes allow_redirects=True to session.send"""
+        # Create a minimal API instance
+        api = PyMISP.__new__(PyMISP)
+        api.root_url = 'https://misp.local/'
+        api.ssl = True
+        api.proxies = None
+        api.cert = None
+        api.auth = None
+        api.timeout = None
+        
+        # Mock the session
+        mock_session = MagicMock()
+        mock_prepped = MagicMock()
+        mock_prepped.headers = {}
+        mock_session.prepare_request.return_value = mock_prepped
+        mock_session.merge_environment_settings.return_value = {}
+        mock_response = MagicMock()
+        mock_session.send.return_value = mock_response
+        
+        api._PyMISP__session = mock_session
+        
+        # Call _prepare_request
+        api._prepare_request('GET', 'events')
+        
+        # Verify that session.send was called with allow_redirects=True
+        mock_session.send.assert_called_once()
+        call_args = mock_session.send.call_args
+        self.assertIn('allow_redirects', call_args.kwargs)
+        self.assertTrue(call_args.kwargs['allow_redirects'])
+
+
+if __name__ == '__main__':
+    unittest.main()