Information Exposure due to the handling of the Proxy-Authorization header across hosts about axios

[justindhillon]

This is handled in lib/adapters/http.js.

My first approach was to just delete Proxy-Authorization whenever we redirect:

function dispatchBeforeRedirect(options, responseDetails) {
  if (options.beforeRedirects.proxy) {
    options.beforeRedirects.proxy(options);
  }
  if (options.beforeRedirects.config) {
    options.beforeRedirects.config(options, responseDetails);
  }
  // Clear Proxy-Authorization header during cross-domain redirects
  delete options.headers['Proxy-Authorization'];
}

My second approach is to remove Proxy-Authorization from header, but then turn it into a veriable returned by options. The same way it is implemented for authorization:

// HTTP basic authentication
let auth = undefined;
if (config.auth) {
  const username = config.auth.username || '';
  const password = config.auth.password || '';
  auth = username + ':' + password;
}

if (!auth && parsed.username) {
  const urlUsername = parsed.username;
  const urlPassword = parsed.password;
  auth = urlUsername + ':' + urlPassword;
}

auth && headers.delete('authorization');

Which way should I fix this security vulnerability?