# Credential leak via referer and redirect inheritance

Secondary transfers or auto-copied URLs forwarding userinfo, fragments, or auth to hosts outside the original scope

_Area: Web infrastructure and server-side requests. Seen in 4 disclosed reports; latest 2026-03-30. Updated 2026-10-24._

## How it works
A request feature treats the original request's credentials or URL as belonging to the whole operation, not to one host. When a redirect, a referenced sub-resource, or an auto-generated header reuses that state, the secret travels to a host the user never authorized. The broken assumption is that "same request" means "same trust boundary"; in practice each hop is a new origin.

## Where it shows up
- Upload/download APIs that follow redirects and surface the final response body to the caller [E1](https://bugbountylibrary.com/r/h1%3A51265.md)
- 307/308 redirects that replay the request body to a new origin [E1](https://bugbountylibrary.com/r/h1%3A51265.md)
- Features that spawn secondary transfers from a user-supplied document (metalink, manifests, playlists) [E2](https://bugbountylibrary.com/r/h1%3A1213181.md)
- Auto-referer or URL-copying options that duplicate the raw URL into a header [E3](https://bugbountylibrary.com/r/h1%3A1101882.md)
- Credential reuse across hosts or protocols (http/ftp) without an explicit opt-in flag [E2](https://bugbountylibrary.com/r/h1%3A1213181.md)

## How to review
For every path that follows a redirect or spawns a sub-transfer, check the invariant: credentials and userinfo are scoped to the original host and scheme, and are dropped on any cross-host or downgrade hop unless the user explicitly opted in (e.g. a trusted-redirect flag). For URL-to-header copies, confirm userinfo and fragment are stripped before the value is emitted [E3](https://bugbountylibrary.com/r/h1%3A1101882.md). For upload APIs, confirm the final response body is not returned to a caller from a different origin [E1](https://bugbountylibrary.com/r/h1%3A51265.md). Test 301 vs 307/308 separately, since body replay differs [E1](https://bugbountylibrary.com/r/h1%3A51265.md).

## Variants seen
- Redirect-following upload returning cross-origin response data to the caller [E1](https://bugbountylibrary.com/r/h1%3A51265.md)
- Body-replaying redirects re-sending an upload to a new origin [E1](https://bugbountylibrary.com/r/h1%3A51265.md)
- Secondary transfers inheriting primary auth across hosts and cleartext protocols [E2](https://bugbountylibrary.com/r/h1%3A1213181.md)
- Auto-referer copying full URL including userinfo and fragment [E3](https://bugbountylibrary.com/r/h1%3A1101882.md)

## Impact and severity
Leaked Basic auth and URL-embedded credentials reach arbitrary third-party hosts and logs [E2](https://bugbountylibrary.com/r/h1%3A1213181.md)[E3](https://bugbountylibrary.com/r/h1%3A1101882.md); cross-origin response disclosure breaks the same-origin boundary [E1](https://bugbountylibrary.com/r/h1%3A51265.md). Severity rises when credentials are long-lived, reused across services, or sent over cleartext, and when the leak is silent to the user.

## Why fixes fail
Fixing one path (redirects) while leaving sibling paths (metalink, auto-referer) unsanitized leaves the same class open; each URL-to-transfer and URL-to-header path needs the same stripping and scoping check [E2](https://bugbountylibrary.com/r/h1%3A1213181.md)[E3](https://bugbountylibrary.com/r/h1%3A1101882.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A51265.md
- E2: https://bugbountylibrary.com/r/h1%3A1213181.md
- E3: https://bugbountylibrary.com/r/h1%3A1101882.md