← Back to release summary

Remove Authorization header upon cross-origin redirect

Category: Network / Connectivity
Type: No developer-visible change
Status: Enabled by default (Chrome 119)
Intent stage: None

Breaking change: Yes
Enterprise impact: None
Spec maturity: Published standard
Web Platform Tests: Yes

WPT details: https://wpt.fyi/results/fetch/api/credentials/authentication-redirection.any.html?label=experimental&label=master&aligned https://wpt.fyi/results/xhr/xhr-authorization-redirect.any.html?label=experimental&label=master&aligned

Summary

The Fetch standard has updated to remove Authorization header on cross origin redirects. Chrome should follow the spec change.

Standards & signals

Specification: https://fetch.spec.whatwg.org/#http-redirect-fetch
Firefox: In development
Safari: Shipped/Shipping — Safari always removed Authorization headers even for the same origin redirects but the behavior has changed to preserve them on same origin redirects.
Web developers: No signals
Tracking bug: https://bugs.chromium.org/p/chromium/issues/detail?id=1393520

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=fetch%2Fapi%2Fcredentials%2Fauthentication-redirection
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Remove%20Authorization%20header%20upon%20cross-origin%20redirect
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Remove%20Authorization%20header%20upon%20cross-origin%20redirect
Baseline status: https://webstatus.dev/?q=Remove%20Authorization%20header%20upon%20cross-origin%20redirect

View on chromestatus.com