From 98c1285d9d78662c38bf14b4a128af01ccfdb446 Mon Sep 17 00:00:00 2001
From: Carlos Garcia Campos <cgarcia@igalia.com>
Date: Tue, 20 Jan 2026 13:17:42 +0100
Subject: [PATCH] Also remove Proxy-Authorization header on cross origin
 redirect

Closes #489
---
 libsoup/soup-session.c |  1 +
 1 files changed, 1 insertions(+)

diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
index 4e6b478b1..e40437ff2 100644
--- a/libsoup/soup-session.c
+++ b/libsoup/soup-session.c
@@ -1192,6 +1192,7 @@ soup_session_redirect_message (SoupSession *session, SoupMessage *msg)
         /* Strip all credentials on cross-origin redirect. */
         if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
                 soup_message_headers_remove (msg->request_headers, "Authorization");
+                soup_message_headers_remove (msg->request_headers, "Proxy-Authorization");
                 soup_message_set_auth (msg, NULL);
         }