# Credential headers across origin redirects

Auth, proxy or custom credential headers surviving a redirect to a different origin, scheme or realm

_Area: Web infrastructure and server-side requests. Seen in 6 disclosed reports; 2 confirmed bounties: $250 and $420; latest 2026-10-30. Updated 2026-11-01._

## How it works
A client attaches a credential header (Authorization, Cookie, Proxy-Authorization, custom auth tokens) to a request, then follows a redirect or re-evaluates per-hop config. The assumption that breaks: that the code strips or re-scopes credentials whenever the destination origin, scheme, or connection mode changes. Stripping is often keyed on header name, container shape, or realm identity, so any mismatch leaves the header attached to a request whose destination the attacker controls [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md)[E5](https://bugbountylibrary.com/r/h1%3A2451113.md)[E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-mrwp-f3q8-3g9p.md). The same failure appears when a proxy injects credentials by default and the code path never opts out [E2](https://bugbountylibrary.com/r/h1%3A3400143.md), or when a server-supplied realm is trusted without binding it to the configured upstream [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-3p65-76g6-3w7r.md).

## Where it shows up
- Redirect handlers with a strip list of header names; check whether the list is complete and matched correctly [E5](https://bugbountylibrary.com/r/h1%3A2451113.md).
- Header containers: plain object vs Node alternating name/value array; `for...in` over an array yields indices [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md).
- `instanceof Array` vs `Array.isArray` on security-relevant options; cross-realm arrays fail the check [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-mrwp-f3q8-3g9p.md).
- Per-hop config re-applied on redirect (proxy, auth) without clearing prior headers [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5f8-grm9-p9fc.md).
- HTTP clients that inject Basic/Bearer auth by default for server-supplied URLs, with no opt-out attribute set [E2](https://bugbountylibrary.com/r/h1%3A3400143.md).
- Parsing `WWW-Authenticate` bearer realm and sending stored credentials to it unvalidated [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-3p65-76g6-3w7r.md).

## How to review
Find every place a credential header is set, then trace every path where the destination can change: redirects, proxy re-evaluation, server-supplied URLs, auth challenges. The invariant: before any request leaves for a destination whose origin, scheme, or connection mode differs from where the credential was scoped, that credential must be absent. Verify the strip logic against every container shape the underlying API accepts, not just the one in tests [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md)[E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-mrwp-f3q8-3g9p.md). Confirm the strip list covers all credential-bearing headers, including Proxy-Authorization and custom tokens [E5](https://bugbountylibrary.com/r/h1%3A2451113.md). For injected credentials, confirm the code path explicitly opts out for untrusted URLs [E2](https://bugbountylibrary.com/r/h1%3A3400143.md). For parsed realms, confirm the host is bound to the configured upstream before credentials are attached [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-3p65-76g6-3w7r.md).

## How finders spotted it
- Noticed a strip helper assumed a plain object and used `for...in`; recalled Node also accepts name/value arrays, so indices never match the regex [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md).
- Read `setProxy()` and saw redirect re-applies proxy logic but never clears prior Proxy-Authorization on a direct hop [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5f8-grm9-p9fc.md).
- Saw a prior advisory fixed Authorization/Cookie stripping, hypothesized sibling headers were missed, and retested [E5](https://bugbountylibrary.com/r/h1%3A2451113.md).
- Noticed the file mixed `Array.isArray` with a custom `instanceof Array` helper for sensitiveHeaders, then tested cross-realm arrays [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-mrwp-f3q8-3g9p.md).
- Code review: a download job built from a server-supplied URL with no credential opt-out attribute; traced the credential manager to confirm unconditional injection [E2](https://bugbountylibrary.com/r/h1%3A3400143.md).
- Recognized the unvalidated-realm pattern from a prior CVE applied to a new proxy auth flow [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-3p65-76g6-3w7r.md).

## Variants seen
- Array-form headers bypassing strip helper [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md).
- Stale Proxy-Authorization after proxy re-evaluation [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5f8-grm9-p9fc.md).
- Incomplete strip list missing Proxy-Authorization and custom tokens [E5](https://bugbountylibrary.com/r/h1%3A2451113.md).
- Cross-realm array disabling sensitiveHeaders [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-mrwp-f3q8-3g9p.md).
- Default credential injection on server-supplied URL [E2](https://bugbountylibrary.com/r/h1%3A3400143.md).
- Unvalidated bearer realm receiving stored credentials [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-3p65-76g6-3w7r.md).

## Impact and severity
Leaked credentials reach attacker-controlled hosts: plaintext Basic auth [E2](https://bugbountylibrary.com/r/h1%3A3400143.md); proxy and custom auth secrets [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5f8-grm9-p9fc.md)[E5](https://bugbountylibrary.com/r/h1%3A2451113.md)[E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-mrwp-f3q8-3g9p.md); upstream registry credentials, worse if cloud IAM-scoped [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-3p65-76g6-3w7r.md). Protocol downgrade exposes secrets to any on-path observer, not just the redirect destination [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md). Severity rises with credential breadth and chaining.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md
- E2: https://bugbountylibrary.com/r/h1%3A3400143.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-j5f8-grm9-p9fc.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-3p65-76g6-3w7r.md
- E5: https://bugbountylibrary.com/r/h1%3A2451113.md
- E6: https://bugbountylibrary.com/r/ghsa%3AGHSA-mrwp-f3q8-3g9p.md