Remove Authorization header upon cross-origin redirect

[annevk]

The behavior defined here is such that if you go A1 -> B -> A2, A2 doesn't see the header. I think that's what we want. If you go A1 -> A2 -> B, B won't see the header. (A1 is making the initial request in both scenarios.)

Tests: ...

Fixes #944.

• At least two implementers are interested (and none opposed):
  • WebKit
  • Gecko
  • Chromium
• Tests are written and can be reviewed and commented upon at:
  • Add tests validating that Authorization headers get dropped on cross origin redirections web-platform-tests/wpt#37145
• Implementation bugs are filed:
  • Chromium: https://bugs.chromium.org/p/chromium/issues/detail?id=1393520
  • Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1802086
  • WebKit: N/A
  • Deno (not for CORS changes): fix(ext/fetch): no auth on cross origin redirect denoland/deno#16745
• MDN issue is filed: Fetch Standard change: Authorization removed upon cross-origin redirects mdn/content#22533

(See WHATWG Working Mode: Changes for more details.)

---

Preview | Diff

[annevk]

@lucacasonato you might still want to adopt this change in Deno I suppose even though it's CORS-adjacent?

@youennf presumably WebKit has tests we could upstream to WPT?

@mozfreddyb can you comment for Gecko here?

@mikewest @jakearchibald can either of you for Chromium?

[lucacasonato]

Very much in favor of this change. Spec changes LGTM.

[valenting]

I have filed https://bugzilla.mozilla.org/show_bug.cgi?id=1802086 for the Gecko work.
This seems like a good change to align on. Thank you Anne!

[mikewest]

I think this is a good change. Perhaps @ricea and/or @camillelamy can fit this in somewhere within their team's work?

[ricea]

If I understand correctly, this only affects Authorization headers that were set by JS, and not cached credentials?

[annevk]

That is correct. User agents credentials are not stored on a request. They are added to a copy of a request just before it goes to the network, essentially. Therefore they only survive redirects if the subsequent URL happens to have the same user agent credentials associated with it.

Tests are at web-platform-tests/wpt#37145. I'll file a Chromium issue and merge this.