The authorization header was not dropped by redirect strategy as expected.

[corneil]

Edit: Discovered that RedirectStrategy was change from Apache HTTP Client 4 -> 5. The change meant header changes were not possible. I copied to RedirectExec interceptor / chain handler and modified it to use the modified request instead of the original request to create a request builder.

[onobc]

This is on the mailing list here w/ 3 options.

[corneil]

This is on the mailing list here w/ 3 options.

I will look into a chain handler that strips the header if I can consistently figure out that we are handling a redirect.

[corneil]

Using a client that supports request changes on redirect is a better option than a custom redirect handler.