fix: strip credential headers on cross-origin redirects

[jbeckwith-oai]

Summary

• Stop forwarding credential-bearing default headers to a different origin when the standard client follows a redirect.
• Share the SDK's complete sensitive-header classification between logging and redirect filtering, including fixed names and credential-like token/key/secret/password suffixes, while preserving Host stripping, same-origin credentials, and Idempotency-Key request semantics.
• Keep idempotency values redacted in logs even though their non-credential protocol header must survive redirected mutating requests.
• Reproduce a trusted-to-attacker 302 with a custom HTTP transport and cover mixed string/symbol header names, api-key, x-api-key, x-amz-security-token, x-auth-token, x-goog-api-key, x-client-secret, api_key, x-password, authorization, cookies, proxy credentials, and harmless header retention.
• Preserve Azure and Bedrock's existing, independent origin and redirect protections; this change does not claim those providers were exposed.

Castiron / generator ownership

No upstream Castiron/compiler/template/schema change or companion regeneration is required.

• CONTRIBUTING.md states SDK-local modifications persist across generations.
• Merged PR fix: harden custom HTTP transports #345 explicitly identifies this exact lib/openai/internal/transport/base_client.rb path as SDK-owned runtime, distinguishes it from Castiron-owned root/client files, and states it will not be overwritten by regeneration.
• Merged PR fix: preserve stream identity with HTTP logging #384 explicitly establishes that Castiron's Ruby renderer does not emit the SDK-owned logging Ruby, RBI, or RBS files used for the shared internal predicate.
• Merged PR fix: prevent symbol-keyed headers from bypassing security filters #383 independently verified Castiron preserves SDK-local changes through its three-way overlay.
• Actual generation PR feat(api): deprecate Sora video APIs #386 updated .castiron.stats.yml, the transformed OpenAPI specification, and generated resources without touching this runtime or its tests.
• This PR modifies only SDK-owned transport/logging runtime, its SDK-owned logging RBI/RBS declarations, and SDK regression tests; generated API sources, schemas, templates, generated signatures, and generation metadata remain unchanged.

Verification

• Confirmed the custom-transport regression fails before the fix because api-key, x-api-key, and x-amz-security-token reach the attacker origin.
• Separately reproduced the reviewer-reported token/key/secret/password suffix and underscore variants failing before extracting the shared full predicate.
• Ruby 4.0 full suite after rebasing onto the latest main: 641 tests, 2,611 assertions, zero failures/errors/skips.
• Ruby 3.4 full suite after rebasing onto the latest main: 641 tests, 2,611 assertions, zero failures/errors/skips.
• Ruby 3.3 full suite after rebasing onto the latest main: 641 tests, 2,611 assertions, zero failures/errors/skips.
• Focused redirect coverage: 6 tests, 66 assertions.
• Logging suite: 35 tests, 360 assertions.
• Azure provider suite: 13 tests, 94 assertions.
• Bedrock provider suite: 25 tests, 163 assertions.
• Full RuboCop, including all SDK-owned/generated RBI files: 2,615 files, zero offenses.
• Sorbet typecheck: zero errors.
• RBS validation: 1,212 files, zero errors.
• bundle exec rake build:gem: succeeds.
• Required thermo-nuclear code-quality review before every push: no findings; one canonical internal credential classifier is shared by both call sites, with matching direct-dispatch RBI/RBS declarations, no generated changes, and no files over 1,000 lines.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.804s for Ruby SDK PR #391.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	174ms
tests/chat-completions-create.test.ts	✅ Passed	227ms
tests/chat-completions-stream.test.ts	✅ Passed	127ms
tests/files-content-binary.test.ts	✅ Passed	130ms
tests/files-create-multipart.test.ts	✅ Passed	140ms
tests/files-list-pagination.test.ts	✅ Passed	173ms
tests/initialize-config.test.ts	✅ Passed	182ms
tests/instance-isolation.test.ts	✅ Passed	176ms
tests/models-list.test.ts	✅ Passed	263ms
tests/responses-background-lifecycle.test.ts	✅ Passed	206ms
tests/responses-body-method-errors.test.ts	✅ Passed	374ms
tests/responses-cancel-timeout.test.ts	✅ Passed	201ms
tests/responses-cancel.test.ts	✅ Passed	207ms
tests/responses-compact-retries.test.ts	✅ Passed	268ms
tests/responses-compact.test.ts	✅ Passed	225ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	136ms
tests/responses-create-advanced.test.ts	✅ Passed	248ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.033s
tests/responses-create-errors.test.ts	✅ Passed	313ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	123ms
tests/responses-create-retries.test.ts	✅ Passed	306ms
tests/responses-create-stream-failures.test.ts	✅ Passed	151ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	215ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.365s
tests/responses-create-stream.test.ts	✅ Passed	95ms
tests/responses-create-terminal-states.test.ts	✅ Passed	311ms
tests/responses-create-timeout.test.ts	✅ Passed	210ms
tests/responses-create.test.ts	✅ Passed	278ms
tests/responses-delete.test.ts	✅ Passed	232ms
tests/responses-input-items-errors.test.ts	✅ Passed	186ms
tests/responses-input-items-list.test.ts	✅ Passed	198ms
tests/responses-input-items-options.test.ts	✅ Passed	222ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	249ms
tests/responses-input-tokens-count.test.ts	✅ Passed	278ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.114s
tests/responses-not-found-errors.test.ts	✅ Passed	345ms
tests/responses-parse.test.ts	✅ Passed	178ms
tests/responses-retrieve-retries.test.ts	✅ Passed	291ms
tests/responses-retrieve.test.ts	✅ Passed	238ms
tests/responses-stored-method-errors.test.ts	✅ Passed	761ms
tests/retry-behavior.test.ts	✅ Passed	3.246s
tests/sdk-error-shape.test.ts	✅ Passed	434ms

View OkTest run #31737452302

_{SDK merge (59e36b1d9872) · head (e6e0db2967db) · base (fff94e789a9d) · OkTest (a845fa206fa4)}

[HAYDEN-OAI]

I found one substantive credential-forwarding gap in the new classification reuse; details inline.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa5af9c23c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

Re-reviewed the updated head. The shared classifier now covers the fixed credential headers plus case-insensitive hyphen/underscore-delimited key, token, secret, password, credential, signature, and authorization suffixes; symbol and mixed-case inputs normalize consistently. Redirect filtering remains gated strictly on an origin change, preserves same-origin credentials, independently strips Host, and correctly exempts the standard non-credential Idempotency-Key while logging still redacts its value. The added end-to-end coverage exercises the reported variants and safe-header retention. My prior finding is resolved and I found no further substantive issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e6e0db2967

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".