fix: strip credential headers on cross-origin redirects - #391

Merged

jbeckwith-oai merged 3 commits into

mainfrom

codex/strip-cross-origin-credential-headers-6ed9

Aug 13, 2026

Commits on Aug 13, 2026

fix: strip credential headers on cross-origin redirects
jbeckwith-oai
committed
a888b54
fix: share complete sensitive header classification
jbeckwith-oai
committed
cbbd8a1
fix: preserve idempotency keys on cross-origin redirects
jbeckwith-oai
committed
e6e0db2