CLI Same-Origin Redirect Policy

Summary

The Spice CLI sends its API key as an X-API-Key header on a reqwest client that previously used the default redirect policy, which follows up to 10 redirects. reqwest sanitises headers when a redirect changes origin, but only the standard set — Authorization, Cookie, Cookie2, Proxy-Authorization, WWW-Authenticate. A custom header like X-API-Key is not in that set, so a runtime, proxy or ingress answering with a cross-origin Location had the key forwarded to whatever that Location named. The fix (PR #12503, fixing #12495) restricts the CLI's HTTP client to same-origin redirects only, so the credential never reaches a new origin.

Key Points

• Root cause: reqwest's default redirect policy follows up to 10 redirects and sanitises only the standard credential headers; X-API-Key survives a cross-origin hop.
• Fix: follow same-origin redirects only, comparing scheme, host and effective port so that http://host and http://host:80 remain one origin.
• Cross-origin Location stops redirect following instead, handing the 3xx back to the caller as a response rather than failing the transport.
• The policy is consulted before the redirected request goes out, so the credential never reaches the new origin.
• The policy lives on the shared context client, so every request-building call site inherits it: the get/post/post_json helpers, plus commands/nsql/mod.rs, search.rs, , , and — none of which builds its own client.