Currently Policy::custom only allows inspecting some fields and returning an Action. That's not sufficient in many cases.
The case I'm looking at right now is that a redirect might go to a different origin. Various headers are already automatically stripped off in that case via remove_sensitive_headers() but there's no way to hook into this right now to remove any custom headers that should be dropped, e.g. API key headers. This is kind of related to e.g. curl's CVE-2018-1000007, which I guess is the reason for remove_sensitive_headers() to exist at all.
The only way to handle this right now seems to be to handle redirects completely manually, which requires a lot more care and code than just removing some headers.
Currently
Policy::customonly allows inspecting some fields and returning anAction. That's not sufficient in many cases.The case I'm looking at right now is that a redirect might go to a different origin. Various headers are already automatically stripped off in that case via
remove_sensitive_headers()but there's no way to hook into this right now to remove any custom headers that should be dropped, e.g. API key headers. This is kind of related to e.g. curl's CVE-2018-1000007, which I guess is the reason forremove_sensitive_headers()to exist at all.The only way to handle this right now seems to be to handle redirects completely manually, which requires a lot more care and code than just removing some headers.