MEDIUM6.1
GO-2025-3420
Sensitive headers incorrectly sent after cross-domain redirect in net/http
Quick fix
GO-2025-3420 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.22.11Details
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.
In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
Are you affected?
Enter the version of the package you're using.