Runtime: UWP: System.Net.Http.HttpClient does not clear Authorization Header for redirect

Created on 8 Sep 2018 · 3Comments · Source: dotnet/runtime

This is not reproducible in Windows.Web.Http.HttpClient or in WPF: System.NET.Http.HttpClient. The forwarded request have no Authorization header set.

Only in UWP: System.Net.Http.HttpClient

To reproduce:
1 - Create a handler that will set Authorization header based on request
2 - Use url that requires Authorization header, request should succeed
3 - Use url that requires Authorization header but forwards to a different host (i.e. REST API call that goes to Amazon Web Services), request fails because header was re-used with a different host.

var handler = new MyHttpClientHandler();
var client = new System.Net.Http.HttpClient(handler);

// Request with Token that will not cause re-direct succeeds
var json = await client.GetAsync(new Uri($"{itemUrl}?token={oAuthCred.Token}&f=json"));
var content = await json.Content.ReadAsStringAsync();
System.Diagnostics.Debug.WriteLine(content);

// Request with Token that will cause re-direct fails with 400 BadRequest
var data = await client.GetAsync(new Uri($"{itemUrl}/data?token={oAuthCred.Token}"));
System.Diagnostics.Debug.WriteLine($"Status code : {data.StatusCode}");

HttpClientHandler sets Authorization header as required by item url

public class MyHttpClientHandler : HttpClientHandler
{
    public MyHttpClientHandler() { }
    protected override Task<System.Net.Http.HttpResponseMessage> SendAsync(System.Net.Http.HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var parts = request.RequestUri.OriginalString.Split("token=");
        if (parts.Length > 1)
        {
            var token = parts[1];
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
        }
        return base.SendAsync(request, cancellationToken);
    }
}

area-System.Net.Http bug

Source