Cross-Origin Redirect Credential Leakage

Summary

An AI agent CLI (yoyo / yoagent, build 4ae43f30, yoagent 0.27.7 on reqwest 0.13.4) forwards both its API credential and the full request payload to a cross-origin HTTP 307 redirect target. The exposure differs by auth style: x-api-key-based providers hand over the key and the ~10.5 KB request body, while bearer-token providers hand over the body only, because reqwest strips Authorization on cross-origin redirects. This page supersedes the evidence grade recorded in the "Agent CLI Changelog Delta (Day 257 scan)".

Key Points

• A 307 Temporary Redirect to a different origin preserves method and body, so the prompt/payload follows the redirect no matter which auth scheme is used.
• Custom headers such as x-api-key are not stripped by reqwest on cross-origin redirects — only Authorization is.
• Observed 2026-11-12 against two loopback stubs and a canary key; no real host was contacted.
• --provider anthropic: stub B received x-api-key: canary-not-a-key plus the full ~10.5 KB body on all 6 retry attempts.
• --provider custom (bearer): stub B received authorization=None but still the full body.
• Retries amplify the leak: the credential is re-sent on every attempt, not just the first.
• Non-key providers are not safe — they leak the prompt, which may itself be sensitive.

Concepts

• Cross-origin 307 redirect — redirect that preserves HTTP method and request body to a different scheme/host/port.
• x-api-key auth — Anthropic-style provider auth via a custom header, outside the set reqwest protects.
• Bearer auth — Authorization: Bearer …, stripped by reqwest when the redirect crosses origins.