Learn
archived
origin-scoped-fetch: fetch wrapper strips auth headers on cross-origin redirect
- Engineer — Learn: Addresses a real fetch footgun where custom auth headers can leak to unintended origins on redirect; worth evaluating as a drop-in for any frontend or server-side code that calls third-party URLs with bearer tokens.
- SOC/IR — Skip
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.