CuraSec

tag: Credential-Leakage · 2 items

Learn archived origin-scoped-fetch: fetch wrapper strips auth headers on cross-origin redirect
2026-10-09 · GitHub Trending · source ↗ #web-security#credential-leakage#open-source
  • Engineer — Learn: Addresses a real fetch footgun where custom auth headers can leak to unintended origins on redirect; worth evaluating as a drop-in for any frontend or server-side code that calls third-party URLs with bearer tokens.
  • SOC/IR — Skip
  • Leader — Skip
Learn archived origin-scoped-fetch: drop auth headers on cross-origin redirects
2026-10-06 · GitHub Trending · source ↗ #web-security#fetch-api#credential-leakage
  • Engineer — Learn: Highlights a subtle but real risk: custom auth headers can follow fetch redirects to unintended origins, leaking credentials. Worth reviewing your fetch usage patterns in web apps — no active exploitation, so no immediate action required.
  • SOC/IR — Skip
  • Leader — Skip