Found this while auditing redirect behavior in a service that uses X-API-Key for authentication. Standard headers like Authorization are stripped correctly on cross-origin redirects, but any custom auth headers survive the redirect to the new origin.

This extends the existing cross-origin header-stripping logic to also cover a configurable list of sensitive header names via the new sensitiveHeaders config option. On a cross-origin redirect, any header in that list is removed from the outgoing request.

Refs #10711.

Summary by cubic

Fixes a security bug where custom auth headers could leak on cross-origin redirects in the Node HTTP adapter. Adds a case-insensitive sensitiveHeaders option with fail-closed origin checks and prototype‑pollution guards.

Description

• Summary of changes

  • Add options.beforeRedirects.sensitiveHeaders to strip caller‑listed headers on cross‑origin redirects (case‑insensitive).
  • Implement isSameOriginRedirect (fail closed on parse errors) and export __isSameOriginRedirect for tests.
  • Validate sensitiveHeaders as an array of strings; reject with ERR_BAD_OPTION_VALUE otherwise.
  • Ignore Object.prototype.sensitiveHeaders when reading config.
  • Add sensitiveHeaders?: string[] to index.d.ts and index.d.cts.
  • Update threat model to follow-redirects@^1.16.0.
  • Move usage notes to PRE_RELEASE_CHANGELOG.md; keep README snippet.

• Reasoning

  • Prevent leaking custom secrets (for example X-API-Key) to other origins while preserving same‑origin behavior.

• Additional context

  • Node HTTP adapter only; unused when maxRedirects is 0.

Docs

Add /docs/ updates with sensitiveHeaders examples and security notes. Keep them aligned with the README snippet and the new entry in PRE_RELEASE_CHANGELOG.md.

Testing

Added/updated unit tests for:

• Cross‑origin stripping, same‑origin preservation, and case‑insensitive matching.
• Instance‑level config and invalid config rejection.
• Fail‑closed origin parsing via __isSameOriginRedirect.
• Prototype‑pollution guard to ignore Object.prototype.sensitiveHeaders.

Semantic version impact

Patch: backward‑compatible security hardening behind an optional Node‑only config.

^{Written for commit d493090. Summary will update on new commits.}