Repair Redirect Credential Leakage

The problem

HTTP clients and SDKs often leak sensitive Authorization, Cookie, or Proxy headers when following redirects to external domains or insecure schemes. These vulnerabilities expose API keys and session tokens to untrusted third-party hosts or man-in-the-middle attackers.

What it does

• Audits redirect callbacks and request cloning logic for credential persistence across authority boundaries.
• Implements per-hop credential stripping for cross-origin, host, port, or scheme transitions.
• Isolates request clones to prevent state contamination during retries or concurrent execution.
• Adds deterministic loopback tests and redacted observability to verify fix efficacy without logging secrets.
• Patches 301-308 status code handling to ensure method and body replay policies remain intact.

Frameworks & tools

Works with any language or HTTP stack including Node.js (Axios/Fetch), Python (Requests/httpx), Go (net/http), and custom SDK wrappers.

Why this beats prompting it yourself

Standard LLM prompts often suggest "just disable redirects" or provide incomplete regex checks that fail on edge cases like port changes or subdomains. This skill follows a rigorous protocol to preserve approved same-origin behavior and timeout budgets while enforcing strict authority validation before dispatch.

Use cases

• Fixing signed request headers that persist after a CDN or object storage redirect.
• Preventing HTTPS-to-HTTP downgrade attacks that leak cookies.
• Hardening API wrappers where shared request objects contaminate retry attempts.
• Refactoring legacy SDKs to strip Proxy-Authorization headers on target changes.