Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Thanks, both points addressed in the fallback parser (the urlutil.parse branch, only used when the WHATWG URL global is unavailable):

1. Default-port normalization: now compares protocol + hostname + a normalized port (defaulting to 443/80) instead of the raw host, so same-origin redirects with an explicit :80/:443 are no longer treated as cross-origin.
2. Fail closed: the catch now returns true, so if the origin can't be determined the credentials are stripped rather than forwarded.

The primary path uses URL.origin, which already normalizes default ports and throws on a malformed location before the strip runs, so it was unaffected; the change is limited to the fallback.

@codex review

Codecov Report

❌ Patch coverage is 60.86957% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.94%. Comparing base (02cad0e) to head (44c1935).
⚠️ Report is 3 commits behind head on 2.x.

@@            Coverage Diff             @@
##              2.x     #813      +/-   ##
==========================================
- Coverage   91.91%   89.94%   -1.98%     
==========================================
  Files           6        6              
  Lines         829      875      +46     
  Branches      225      243      +18     
==========================================
+ Hits          762      787      +25     
- Misses         67       88      +21     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

Thanks @chatgpt-codex-connector, all three addressed in 44c1935:

1. Don't clear caller auth in place - the cross-origin branch now clones args (Object.assign({}, args)) and drops auth/digestAuth/credential headers on the clone, so reusing the same options object after a redirect still authenticates against the original origin. Added a regression test asserting opts.auth/opts.headers are untouched.

2. Preserve proxy auth when proxied - when a proxy tunnel is in use (proxyTunnelAgent), Proxy-Authorization is kept (it authenticates the unchanged proxy hop, not the redirected origin), so pinned authenticated proxies no longer 407 on cross-origin redirects. It's still stripped when there's no proxy (where it would otherwise reach the target origin).

3. Same-origin object-URL redirects - origin detection now derives an href from the parsed URL components (host/hostname/port/path) when the caller passes an options-style object without href, so same-origin redirects are detected correctly instead of hitting the fail-closed path and stripping credentials. (Truly-undeterminable origins still fail closed.)

The Gemini fallback-parser points (default-port normalization + fail-closed) from the earlier review are already in.

Summary

• Reviewed the current PR head and confirmed the three follow-up points in the trigger are already present:
  • Options-style request objects without href are handled by deriving an origin href from host/hostname, port, and path, while undeterminable origins fail closed. lib/urllib.jsL73-L99
  • The fallback parser compares protocol, hostname, and normalized default ports, and parser errors fail closed. lib/urllib.jsL104-L115
  • Cross-origin redirects clone args, conditionally preserve Proxy-Authorization when a proxy tunnel is in use, and clear auth only on the redirect clone. lib/urllib.jsL756-L772
• Confirmed regression coverage exists for stripping cross-origin credential headers, preserving same-origin credential headers, stripping cross-origin auth, preserving same-origin auth, and not mutating the caller’s reusable options object. test/redirect-cross-origin.test.jsL63-L135
• No code changes were needed, so I did not create a new commit or pull request.

Testing

• ✅ ./node_modules/.bin/mocha -t 30000 test/redirect-cross-origin.test.js
• ❌ npm test -- --grep redirect-cross-origin — this was an invalid invocation for this repo’s npm scripts because the grep argument was forwarded as an extra file pattern; it ran broader tests and failed outside the targeted redirect test path.

View task →