fix(ext/fetch): no auth on cross origin redirect

ext/fetch/26_fetch.js

@@ -348,6 +348,16 @@ async function mainFetch(req, recursive, terminator) {
   return response;
 }
 
+/**
+ * @param {URL} a
+ * @param {URL} b
+ * @returns {boolean}
+ */
+function isSameOrigin(a, b) {
+  if (a.origin === null) return false;
+  return a.origin === b.origin;
+}
+
 /**
  * @param {InnerRequest} request
  * @param {InnerResponse} response
@@ -385,6 +395,7 @@ function httpRedirectFetch(request, response, terminator) {
       "Can not redeliver a streaming request body after a redirect",
     );
   }
+  let clearBodyHeaders = false;
   if (
     ((response.status === 301 || response.status === 302) &&
       request.method === "POST") ||
@@ -394,12 +405,18 @@ function httpRedirectFetch(request, response, terminator) {
   ) {
     request.method = "GET";
     request.body = null;
+    clearBodyHeaders = true;
+  }
+  const noAuth = !isSameOrigin(request.currentUrl(), locationURL);
+  if (clearBodyHeaders || noAuth) {
     for (let i = 0; i < request.headerList.length; i++) {
+      const headerName = byteLowerCase(request.headerList[i][0]);
       if (
-        ArrayPrototypeIncludes(
-          REQUEST_BODY_HEADER_NAMES,
-          byteLowerCase(request.headerList[i][0]),
-        )
+        noAuth && headerName == "authorization" ||
+        clearBodyHeaders && ArrayPrototypeIncludes(
+            REQUEST_BODY_HEADER_NAMES,
+            headerName,
+          )
       ) {
         ArrayPrototypeSplice(request.headerList, i, 1);
         i--;

tools/wpt/expectation.json

@@ -6150,12 +6150,8 @@
       "credentials": {
         "authentication-basic.any.html": true,
         "authentication-basic.any.worker.html": true,
-        "authentication-redirection.any.html": [
-          "getAuthorizationHeaderValue - cross origin redirection"
-        ],
-        "authentication-redirection.any.worker.html": [
-          "getAuthorizationHeaderValue - cross origin redirection"
-        ],
+        "authentication-redirection.any.html": true,
+        "authentication-redirection.any.worker.html": true,
         "cookies.any.html": [
           "Include mode: 1 cookie",
           "Include mode: 2 cookies",