Superagent: Redirects should remove `Authorization` header when going to different host (nodejs)

[pszabop]

Redirects should remove the Authorization header when going to different hosts, because otherwise the contents of Authorization is sent to third parties which is a security vulnerability. It also breaks applications.

See discussion about vulnerability for Apple's webkit circa 2011:

See also discussion on python request vulnerability.

See issue when I was using superagent to have a redirect from an app using Authorization to Minio that was expecting its own Authorization header.

See superagent header removal code which is called from code that detects whether the host has changed.

[kornelski]

Thanks for the report. It'll be fixed in the next release

[pszabop]

FYI, the host check is too strict because you are supposed to check for "domain or subdomain". superagent just checks to see if the host is different, it doesn't check to see if it is a valid subdomain.

I don't have anything that breaks because of this right now but FYI here to someone who this might break.

See supposedly more correct example here

[rickknowles-cognitant]

I have a concrete use case for this when accessing the docker registry v2's blobs API using superagent. When backed by an S3 bucket, the reigstry sends a 307 to a pre-signed S3 url, which of course 400's when it gets an unrecognised authorization header.

Nice easy case to reproduce.