Drop Cookie header across domains.

Fixes #183
follow-redirects · Jan 10, 2022 · 8b347cb · 8b347cb
1 parent 6f5029a
commit 8b347cb
Show file tree

Hide file tree

Showing 2 changed files with 175 additions and 182 deletions.
diff --git a/index.js b/index.js
@@ -392,9 +392,9 @@ RedirectableRequest.prototype._processResponse = function (response) {
     var redirectUrlParts = url.parse(redirectUrl);
     Object.assign(this._options, redirectUrlParts);
 
-    // Drop the Authorization header if redirecting to another domain
+    // Drop the confidential headers when redirecting to another domain
     if (!(redirectUrlParts.host === currentHost || isSubdomainOf(redirectUrlParts.host, currentHost))) {
-      removeMatchingHeaders(/^authorization$/i, this._options.headers);
+      removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);
     }
 
     // Evaluate the beforeRedirect callback