{"version":"2.1.224","anchor":"plugin-archive-downloads-are-checked-on-every-redirect-hop","canonical_anchor":"plugin-archive-downloads-are-checked-on-every-redirect-hop","heading":"Plugin archive downloads are checked on every redirect hop","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/plugin-archive-downloads-are-checked-on-every-redirect-hop","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Plugin archive downloads are checked on every redirect hop\n\nPlugin archive downloads re-check policy at every redirect and strip headers on cross-origin hops.\n\n**What**\n\nInstalling a plugin from an archive URL now re-applies the URL policy at each redirect, and refuses the install if any hop fails it. Headers inherited from the marketplace are stripped when a redirect crosses to a different origin, and a sha256 that does not match aborts the install.\n\n**Details**\n\n- Marketplace catalog redirects must stay on the same origin, or be https to a host that is neither loopback nor a cloud metadata address.\n- An archive that does not actually contain the component paths its marketplace entry declares is rejected, with advice on repackaging.\n\n**Evidence**\n\n`plugin archive redirect policy rejected`\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}