@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects

@@ -19,7 +19,8 @@ const Tap = require('./tap');
 const internals = {
     jsonRegex: /^application\/([a-z0-9.]*[+-]json|json)$/,
     shallowOptions: ['agent', 'agents', 'beforeRedirect', 'payload', 'redirected'],
-    httpOptions: ['secureProtocol', 'ciphers', 'lookup', 'family', 'hints']
+    httpOptions: ['secureProtocol', 'ciphers', 'lookup', 'family', 'hints'],
+    sensitiveCrossHostHeaders: new Set(['authorization', 'cookie', 'proxy-authorization'])
 };
 
 
@@ -248,13 +249,12 @@ internals.Client = class {
                 redirectOptions.timeout = (redirectOptions.timeout - elapsed).toString();           // stringify to not drop timeout when === 0
             }
 
-            // When redirecting to a new hostname, remove the authorization and cookie headers
+            // When redirecting to a new hostname, remove sensitive credential headers
             if (redirectOptions.headers) {
                 const parsedLocation = new URL(location);
                 if (uri.hostname !== parsedLocation.hostname) {
                     for (const header of Object.keys(redirectOptions.headers)) {
-                        const lowerHeader = header.toLowerCase();
-                        if (lowerHeader === 'authorization' || lowerHeader === 'cookie') {
+                        if (internals.sensitiveCrossHostHeaders.has(header.toLowerCase())) {
                             delete redirectOptions.headers[header];
                         }
                     }

@@ -408,7 +408,7 @@ describe('request()', () => {
         http2.close();
     });
 
-    it('handles redirections with new hostname, removing authorization and cookie headers', async (flags) => {
+    it('handles redirections with new hostname, removing authorization, cookie, and proxy-authorization headers', async (flags) => {
 
         const handler1 = (req, res) => {
 
@@ -418,8 +418,8 @@ describe('request()', () => {
 
         const handler2 = (req, res) => {
 
-            // request must have 'x-foo' header, but must not have 'authorization' or 'cookie'
-            if (req.headers.authorization || req.headers.cookie || !req.headers['x-foo']) {
+            // request must have 'x-foo' header, but must not have 'authorization', 'cookie' or 'proxy-authorization'
+            if (req.headers.authorization || req.headers.cookie || req.headers['proxy-authorization'] || !req.headers['x-foo']) {
                 res.writeHead(500);
             }
 
@@ -432,6 +432,7 @@ describe('request()', () => {
         const headers = {
             authorization: 'some-auth-key',
             cookie: 'some-cookie',
+            'proxy-authorization': 'some-proxy-auth',
             'x-foo': 'something-else'
         };
 
@@ -441,6 +442,36 @@ describe('request()', () => {
         http2.close();
     });
 
+    it('preserves proxy-authorization header on same-hostname redirect', async (flags) => {
+
+        let gen = 0;
+        const handler = (req, res) => {
+
+            if (!gen++) {
+                res.writeHead(301, { 'Location': '/' });
+                res.end();
+                return;
+            }
+
+            // proxy-authorization must persist across same-host redirect
+            if (req.headers['proxy-authorization'] !== 'some-proxy-auth') {
+                res.writeHead(500);
+            }
+
+            res.end();
+        };
+
+        const server = await internals.server(handler);
+
+        const headers = {
+            'proxy-authorization': 'some-proxy-auth'
+        };
+
+        const res = await Wreck.request('get', 'http://localhost:' + server.address().port, { redirects: 1, headers });
+        expect(res.statusCode).to.equal(200);
+        server.close();
+    });
+
     it('handles redirections from http to https', async (flags) => {
 
         const handler = (req, res) => {