From 285faea567e1e2a95226201175dbf745a64a2439 Mon Sep 17 00:00:00 2001
From: Changqing Li <changqing.li@windriver.com>
Date: Fri, 20 Mar 2026 15:04:22 +0800
Subject: [PATCH 4/4] Also remove Proxy-Authorization header on cross origin
 redirect

Closes #489

Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/98c1285d9d78662c38bf14b4a128af01ccfdb446]
CVE: CVE-2026-1539

Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
 libsoup/soup-session.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
index cc0d04c..0361856 100644
--- a/libsoup/soup-session.c
+++ b/libsoup/soup-session.c
@@ -1190,6 +1190,7 @@ soup_session_redirect_message (SoupSession *session, SoupMessage *msg)
 	/* Strip all credentials on cross-origin redirect. */
 	if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
 		soup_message_headers_remove (msg->request_headers, "Authorization");
+		soup_message_headers_remove (msg->request_headers, "Proxy-Authorization");
 		soup_message_set_auth (msg, NULL);
 	}
 
-- 
2.34.1

