fix(egress): drop credentials on cross-origin redirects by default

The stripping was gated on a `redirectPolicy` being supplied at all, so the
many callers that pass none — the data-drain webhook and Slack's `url_private`
upload among them — handed their Authorization header to whatever host a
redirect named. Two reviewers flagged the same thing at two different call
sites, which is the tell that the default was wrong rather than those sites.

Keeping credentials is now the explicit opt-in it reads as, and `host` always
goes, since it describes the origin being left.

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.server.ts

@@ -1054,21 +1054,23 @@ export async function secureFetchWithPinnedIP(
             if (redirectHeaders && hop.dropBody) {
               redirectHeaders = stripHeaders(redirectHeaders, ENTITY_HEADERS)
             }
-            if (
-              redirectHeaders &&
-              redirectPolicy &&
-              isCrossOrigin &&
-              (redirectPolicy.mode === 'standard' ||
-                !redirectPolicy.sendCredentialsOnCrossOriginRedirect)
-            ) {
-              const sensitiveHeaders = redirectPolicy.sendCredentialsOnCrossOriginRedirect
-                ? ['host']
-                : [
-                    'host',
-                    ...CROSS_ORIGIN_CREDENTIAL_HEADERS,
-                    ...(redirectPolicy.sensitiveHeaders ?? []),
-                  ]
-              redirectHeaders = stripHeaders(redirectHeaders, sensitiveHeaders)
+            // Credentials are dropped on a cross-origin hop unless a policy
+            // explicitly asks to keep them. Gating this on a policy being
+            // supplied at all, as it once was, meant the many callers that pass
+            // none handed their Authorization header to whatever host the
+            // redirect named. `host` always goes: it describes the old origin.
+            if (redirectHeaders && isCrossOrigin) {
+              const keepCredentials = redirectPolicy?.sendCredentialsOnCrossOriginRedirect === true
+              redirectHeaders = stripHeaders(
+                redirectHeaders,
+                keepCredentials
+                  ? ['host']
+                  : [
+                      'host',
+                      ...CROSS_ORIGIN_CREDENTIAL_HEADERS,
+                      ...(redirectPolicy?.sensitiveHeaders ?? []),
+                    ]
+              )
             }
             if (redirectHeaders && options.stripAuthOnRedirect) {
               redirectHeaders = stripHeaders(redirectHeaders, ['authorization'])

apps/sim/lib/core/security/pinned-redirect-replay.server.test.ts

@@ -81,7 +81,7 @@ describe('secureFetchWithPinnedIP redirect replay', () => {
     expect(hops).toEqual([])
   })
 
-  it('preserves historical replay when no redirect policy is present', async () => {
+  it('replays method and body without a policy, but not credentials cross-origin', async () => {
     const hops: RecordedHop[] = []
     const target = await startRecordingServer(hops)
     const origin = await startServer((req, res) => {
@@ -103,10 +103,34 @@ describe('secureFetchWithPinnedIP redirect replay', () => {
 
     expect(response.status).toBe(200)
     expect(hops).toHaveLength(1)
+    // Legacy replay semantics: the method and body survive a 303.
     expect(hops[0].method).toBe('POST')
     expect(hops[0].body).toBe('{"message":"legacy"}')
-    expect(hops[0].headers.authorization).toBe('Bearer legacy-token')
-    expect(hops[0].headers.host).toBe('legacy.example')
+    // ...but the credentials do not travel to another origin just because this
+    // caller passed no redirect policy.
+    expect(hops[0].headers.authorization).toBeUndefined()
+    expect(hops[0].headers.host).not.toBe('legacy.example')
+  })
+
+  it('keeps credentials cross-origin only when a policy explicitly opts in', async () => {
+    const hops: RecordedHop[] = []
+    const target = await startRecordingServer(hops)
+    const origin = await startServer((req, res) => {
+      req.resume()
+      res.writeHead(303, { location: `${target}/after` })
+      res.end()
+    })
+
+    await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+      method: 'POST',
+      body: '{"message":"opt-in"}',
+      headers: { Authorization: 'Bearer keep-me', 'Content-Type': 'application/json' },
+      redirectPolicy: { mode: 'legacy', sendCredentialsOnCrossOriginRedirect: true },
+      profile: 'configuredEndpoint',
+    })
+
+    expect(hops).toHaveLength(1)
+    expect(hops[0].headers.authorization).toBe('Bearer keep-me')
   })
 
   it('lets a legacy block withhold credentials without changing its replay semantics', async () => {