Fix credential headers on cross-authority redirects

[Arnab Nandy (arnabnandy7)]

Description

Fixes credential leakage across cross-authority HTTP redirects in azure-core.

RedirectPolicy previously removed only the Authorization header. Custom credential headers added by KeyCredentialPolicy or AzureKeyCredentialPolicy, such as api-key, could be forwarded or reapplied when a redirect changed the request authority.

This pull request:

• Tracks key credential headers and their originating authority.
• Removes these headers when a redirect changes the scheme, host, or effective port.
• Prevents credential policies from reapplying the headers to an untrusted redirect destination.
• Preserves credentials for same-authority redirects.
• Preserves the existing behavior of removing Authorization on redirects.
• Adds synchronous and asynchronous coverage for both policy orderings and same-authority redirects.
• Documents the behavior in JavaDoc and the azure-core CHANGELOG.

Fixes #50215

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[github-actions]

Thank you for your contribution Arnab Nandy (@arnabnandy7)! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
34 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR hardens azure-core redirect handling to prevent key-based credential headers (for KeyCredentialPolicy / AzureKeyCredentialPolicy) from being forwarded or re-applied when an HTTP redirect changes request authority (scheme/host/effective port), while preserving the existing behavior of clearing Authorization on redirects.

Changes:

• Track “sensitive” key-credential header names in the request context along with their originating authority, and strip them when redirect authority changes.
• Update KeyCredentialPolicy to avoid re-injecting (and actively remove) the key header on cross-authority redirected requests.
• Add sync+async tests for cross-authority vs same-authority redirects and for both policy orderings; document the behavior and update the azure-core changelog.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
sdk/core/azure-core/src/main/java/com/azure/core/http/policy/RedirectPolicy.java	Track and remove key credential headers on cross-authority redirects; keep removing Authorization.
sdk/core/azure-core/src/main/java/com/azure/core/http/policy/KeyCredentialPolicy.java	Gate key header injection on whether the current request authority matches the original authority.
sdk/core/azure-core/src/test/java/com/azure/core/http/policy/RedirectPolicyTest.java	Add sync/async coverage for cross-authority clearing and same-authority preservation across policy orderings.
sdk/core/azure-core/CHANGELOG.md	Document the redirect hardening behavior as a bug fix.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.