Don't re-apply persistent credential headers across cross-origin redirects

[oalders]

Summary

Headers set via add_header() — notably Authorization — were re-applied by _modify_request() to cross-origin redirect targets, undoing the credential stripping LWP::UserAgent performs on its own cross-origin redirects.

_modify_request() now detects a cross-origin redirect hop using the response LWP::UserAgent threads into request(), and skips re-applying Authorization/Proxy-Authorization to a different origin. This mirrors LWP's own redirect handling. Set allow_credentialed_redirects to a true value to opt back in.

Details

• A new private _is_cross_origin() compares scheme and host_port of the previous hop and the new request (after canonical, so case-only and default-port differences don't count as cross-origin).
• request() passes the LWP-threaded triggering response into _modify_request() so the cross-origin check only fires on redirect/auth re-entry, never on a normal first request.
• Same-origin redirects, and the allow_credentialed_redirects opt-out, preserve the header exactly as before.

Tests

t/cross-origin-redirect.t drives LWP's real redirect loop over a mocked transport and asserts, table-driven:

• cross-origin strips Authorization and Proxy-Authorization
• same-origin preserves the header
• a different port is cross-origin (strips)
• a case-only host difference is same-origin (preserves)
• allow_credentialed_redirects opts back in (preserves)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.95%. Comparing base (c0adc38) to head (c1d0b83).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #433      +/-   ##
==========================================
+ Coverage   89.84%   89.95%   +0.10%     
==========================================
  Files           3        3              
  Lines         857      866       +9     
  Branches      226      227       +1     
==========================================
+ Hits          770      779       +9     
  Misses         37       37              
  Partials       50       50              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.