Security: Custom auth headers and proxy-authorization not stripped on cross-origin redirect

Summary

node-fetch strips authorization, www-authenticate, cookie, and cookie2 on cross-origin redirect (src/index.js:200-213), but does NOT strip:

1. proxy-authorization - Proxy credentials forwarded to redirect target
2. Custom auth headers - X-API-Key, X-Auth-Token, etc. forwarded verbatim

Affected Code

src/index.js, lines 200-213:

if (!isDomainOrSubdomain(request.url, locationURL) || !isSameProtocol(request.url, locationURL)) {
    for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
        requestOptions.headers.delete(name);
    }
}

Impact

Custom auth headers (extremely common in API usage) leak on cross-origin redirect. proxy-authorization also leaks.

Comparison

• curl: Strips all credentials including custom headers unless --location-trusted
• follow-redirects: Strips proxy-authorization (node-fetch does not)
• Python requests: Same limitation for custom headers

Severity

CWE-200 | Medium

AI-assisted source code review, manually verified.