fix(redirect): strip authorization header on cross-origin 307/308 redirects (#1844)

[vaibhavmashal]

Fixes #1844

Description

Per RFC 9110 Section 15.4, credentials such as \Authorization\ and \Cookie\ headers must not be forwarded to a different origin on HTTP redirects.

Previously, while 301, 302, and 303 redirects stripped sensitive headers via \cleanHeader(headers, changesOrigin), 307 and 308 redirects preserved the method and headers without stripping credentials on cross-origin redirects.

Solution

• Updated \changesOrigin\ check in \src/node/index.js\ to compare
  ew URL(url).origin !== new URL(this.url).origin\ across protocol, host, and port.
• For 307 and 308 status codes, remove \�uthorization\ and \cookie\ headers when \changesOrigin\ is true.
• Added unit test coverage in \ est/node/redirects-other-host.js\ verifying that the \Authorization\ header is stripped on cross-origin 307/308 redirects.

[Copilot]

🟡 Changes recommended

The new behavior also strips Cookie, but the added tests only assert Authorization, leaving part of the security behavior unverified.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR addresses a security issue in the Node redirect implementation by ensuring sensitive credentials are not forwarded when following cross-origin redirects, specifically covering 307/308 behavior that previously preserved headers.

Changes:

• Update redirect origin-change detection to compare full URL origins (scheme/host/port).
• Strip authorization and cookie headers on cross-origin 307/308 redirects.
• Add unit tests asserting Authorization is stripped on cross-origin 307/308 POST redirects.

File summaries

File	Description
src/node/index.js	Computes changesOrigin via URL.origin and strips credential headers on cross-origin 307/308 redirects.
test/node/redirects-other-host.js	Adds tests for 307/308 POST redirects to ensure Authorization is not retained across origins.

Review details

Suppressed comments (1)

test/node/redirects-other-host.js:219

• This test verifies Authorization stripping but doesn’t cover the newly added behavior to also strip Cookie on cross-origin 308 redirects, so a regression on Cookie stripping would go unnoticed.

      const request_ = request
        .post(`${base}/test-308`)
        .set('Authorization', 'Bearer secret-token')
        .redirects(1);
      request_.end((error, res) => {

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.