fix(request): strip credentials on cross-origin redirects

.changelog/strip-cross-origin-credentials.md

@@ -0,0 +1,5 @@
+---
+wallet-cli: patch
+---
+
+Strip credential-bearing headers when `tempo request` follows a cross-origin redirect.

src/commands/request.ts

@@ -474,25 +474,31 @@ async function fetchWithRedirects(
   }
 }
 
-function redirectRequest(request: FetchPlan, status: number, location: string): FetchPlan {
-  const nextUrl = new URL(location, request.url).toString();
+export function redirectRequest(request: FetchPlan, status: number, location: string): FetchPlan {
+  const nextUrl = new URL(location, request.url);
   const init = cloneRequestInit(request.init);
+  const headers = new Headers(init.headers);
   const method = init.method?.toUpperCase() ?? "GET";
 
+  if (new URL(request.url).origin !== nextUrl.origin) {
+    headers.delete("authorization");
+    headers.delete("cookie");
+    headers.delete("proxy-authorization");
+  }
+
   if (
     (status === 301 || status === 302 || status === 303) &&
     method !== "GET" &&
     method !== "HEAD"
   ) {
     init.method = "GET";
     delete init.body;
-    const headers = new Headers(init.headers);
     headers.delete("content-length");
     headers.delete("content-type");
-    init.headers = headers;
   }
 
-  return { init, url: nextUrl };
+  init.headers = headers;
+  return { init, url: nextUrl.toString() };
 }
 
 function isRedirectStatus(status: number) {

test/request.test.ts

@@ -13,6 +13,7 @@ import {
   buildTopUpTransactionRequest,
   isSessionInvalidationResponse,
   parseRequestArgs,
+  redirectRequest,
   resolvePaymentIdentity,
   runRequest,
   sessionChallengeFromHeader,
@@ -177,6 +178,52 @@ describe("request command", () => {
     expect(stdout.text()).toBe("target");
   });
 
+  it("strips credentials on cross-origin redirects", () => {
+    const redirected = redirectRequest(
+      {
+        init: {
+          headers: {
+            Authorization: "Bearer secret-token",
+            Cookie: "session=secret-cookie",
+            "Proxy-Authorization": "Basic proxy-secret",
+          },
+          method: "GET",
+        },
+        url: "https://api.example.com/redirect",
+      },
+      302,
+      "https://other.example.com/target",
+    );
+    const headers = new Headers(redirected.init.headers);
+
+    expect(headers.get("authorization")).toBeNull();
+    expect(headers.get("cookie")).toBeNull();
+    expect(headers.get("proxy-authorization")).toBeNull();
+  });
+
+  it("preserves credentials on same-origin redirects", () => {
+    const redirected = redirectRequest(
+      {
+        init: {
+          headers: {
+            Authorization: "Bearer secret-token",
+            Cookie: "session=secret-cookie",
+            "Proxy-Authorization": "Basic proxy-secret",
+          },
+          method: "GET",
+        },
+        url: "https://api.example.com/redirect",
+      },
+      302,
+      "/target",
+    );
+    const headers = new Headers(redirected.init.headers);
+
+    expect(headers.get("authorization")).toBe("Bearer secret-token");
+    expect(headers.get("cookie")).toBe("session=secret-cookie");
+    expect(headers.get("proxy-authorization")).toBe("Basic proxy-secret");
+  });
+
   it("fails when the redirect limit is exceeded", async () => {
     const server = await testServer((_request, response) => {
       response.statusCode = 302;