# Cross-origin redirect credential header leak

Redirect code strips some credential headers but forwards others, or skips stripping on one API surface

_Area: Web infrastructure and server-side requests. Seen in 6 disclosed reports; 4 confirmed bounties, median $405, range $200-$420; latest 2026-10-20. Updated 2026-10-23._

## How it works
A credential header is scoped to the origin it was meant for. When a redirect changes scheme, host or port, that header must be dropped before the new request is sent. The break happens when the strip step is incomplete: it clears the obvious headers (Authorization, Cookie) but forwards others that also carry secrets, or it never runs at all on one code path. The redirect target, often attacker-controlled via an open redirect, then receives the credential. The same failure appears when a tool replays a request: stored credentials are re-applied to the redirected request without re-scoping to the new host [E4](https://bugbountylibrary.com/r/h1%3A302651.md).

## Where it shows up
- Redirect-following code with a hardcoded list of headers to strip, rather than an allowlist of safe headers [E3](https://bugbountylibrary.com/r/h1%3A2451113.md)[E5](https://bugbountylibrary.com/r/h1%3A2390009.md).
- Credential-bearing headers outside the usual pair: Proxy-Authorization, x-auth-token, custom auth headers [E3](https://bugbountylibrary.com/r/h1%3A2451113.md)[E5](https://bugbountylibrary.com/r/h1%3A2390009.md).
- Strip helpers that assume one container shape; Node accepts headers as an object or an alternating name/value array, and a `for...in` over the array yields indices that never match [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md).
- Redirect code that passes the original options/headers through a copy without an explicit headers override [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cr65-55v9-xhvv.md).
- Sibling API surfaces sharing redirect logic (request vs fetch) where only one was fixed [E6](https://bugbountylibrary.com/r/h1%3A2243710.md).
- Replay tools that auto-follow redirects while holding configured auth [E4](https://bugbountylibrary.com/r/h1%3A302651.md).

## How to review
Enumerate every path that follows a redirect or spawns a secondary request: request, fetch, retry, proxy-chain, replay. Diff the strip lists across them. The invariant: on any hop where scheme, host or port changes, all credential-bearing headers are removed before sending, and only an explicit allowlist of non-sensitive headers survives. Confirm the strip helper handles every header container shape the underlying API accepts [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md). For replay tools, confirm stored credentials are bound to the original origin [E4](https://bugbountylibrary.com/r/h1%3A302651.md). Test each surface separately.

## Variants seen
- Proxy-Authorization and x-auth-token omitted from the strip list in undici.request [E3](https://bugbountylibrary.com/r/h1%3A2451113.md)[E5](https://bugbountylibrary.com/r/h1%3A2390009.md).
- Strip helper no-ops on array-form headers, leaking Authorization/Cookie/Proxy-Authorization [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md).
- Redirect copy preserves the full header map with no origin comparison [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cr65-55v9-xhvv.md).
- Cookie not stripped in undici fetch while request stripped it [E6](https://bugbountylibrary.com/r/h1%3A2243710.md).
- Replay tool reusing Platform Authentication credentials across an open redirect [E4](https://bugbountylibrary.com/r/h1%3A302651.md).

## Why fixes fail
Fixes added a strip list and missed sibling headers [E3](https://bugbountylibrary.com/r/h1%3A2451113.md)[E5](https://bugbountylibrary.com/r/h1%3A2390009.md), fixed one API surface while the fetch wrapper kept leaking Cookie [E6](https://bugbountylibrary.com/r/h1%3A2243710.md), and assumed a single header container shape [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md). Per-surface patches leave gaps.

## Impact and severity
Credentials and cookies leaked to third-party hosts, enabling account or proxy access. Severity rises with credential power and with an open redirect making the leak trivially reachable.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-q3jh-wrc6-jgq8.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-cr65-55v9-xhvv.md
- E3: https://bugbountylibrary.com/r/h1%3A2451113.md
- E4: https://bugbountylibrary.com/r/h1%3A302651.md
- E5: https://bugbountylibrary.com/r/h1%3A2390009.md
- E6: https://bugbountylibrary.com/r/h1%3A2243710.md