AIKIDO-2026-231269

TL;DR

follow-redirects strips Authorization, Cookie, Proxy-Authorization, and any declared sensitiveHeaders before a redirect to a different host or a protocol downgrade by looping over the headers object with for...in in removeMatchingHeaders. When an application supplies headers as an array (the alternating name/value form Node's http.request also accepts), for...in yields numeric indices instead of header names, so the filter never matches and nothing is stripped. The request to the new destination still includes those credential headers, with no error or warning. The fix converts headers in array form to a plain object before the sensitive header filter runs.