Xamarin-android: AndroidClientHandler doesn't clear Authorization header on redirect

[dominik-weber]

We have discovered that the AndroidClientHandler transmits all headers when following redirects with AllowAutoRedirect=true. I could not find any authoritative info how this should be handled, however the HttpClientHandler seems to clear the Authorization header when redirecting (see https://github.com/dotnet/corefx/blob/master/src/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/RedirectHandler.cs).
From my testing, it appears the NSUrlSessionHandler does so too.

Should we change the AndroidClientHandler to be more consistent with the other platforms on this issue?

VS bug #737231

[spouliot]

From my testing, it appears the NSUrlSessionHandler does so too.

@dominik-weber can you double check that ? our own tests show the NSUrlSessionHandler behaviour to be fine - maybe a different handler was used?

[dominik-weber]

@spouliot I meant to say the NSUrlSessionHandler does clear the auth header, just as the HttpClientHandler does. Sorry for the confusion 🙁

[jonpryor]

This fix was applied to d15-9 via commit c0813c522e3dae40c6a79be727f84beaa0f7e6fe, and has been released in Xamarin.Android 9.1 SR4.