diff --git a/lib/httparty/request.rb b/lib/httparty/request.rb index 36b7d357..8809590e 100644 --- a/lib/httparty/request.rb +++ b/lib/httparty/request.rb @@ -228,6 +228,7 @@ def query_string_normalizer def setup_raw_request if options[:headers].respond_to?(:to_hash) headers_hash = options[:headers].to_hash + headers_hash.delete('Authorization') if !send_authorization_header? else headers_hash = nil end diff --git a/spec/httparty/request_spec.rb b/spec/httparty/request_spec.rb index 638447b3..1c1d1a37 100644 --- a/spec/httparty/request_spec.rb +++ b/spec/httparty/request_spec.rb @@ -1384,6 +1384,25 @@ end end end + + context "when redirecting to a different host" do + before do + @redirect = stub_response("", 302) + @ok = stub_response('bar', 200) + @request.options[:headers] = {'Authorization' => 'Bearer xyz'} + end + + before(:each) do + allow(@http).to receive(:request).and_return(@redirect, @ok) + end + + it "should not send Authorization header" do + @redirect['location'] = 'http://example.com/v1' + @request.perform + @request.send(:setup_raw_request) + expect(@request.instance_variable_get(:@raw_request)['authorization']).to be_nil + end + end end context "with POST http method" do