potiuk opened a new pull request, #72165: URL: https://github.com/apache/airflow/pull/72165
## Why `HttpHook.get_conn` applies every unrecognised key from a connection's `extra` field as a persistent session header: ```python session.headers.update(conn_extra_options) # _configure_session_from_extra ``` and the hook's own docstring documents that field as the place to put them — *"headers can also be specified in the Extra field in json format"*. `requests` removes only the `Authorization` header when a redirect crosses to a different host (`Session.rebuild_auth` → `should_strip_auth`). A credential carried under any **other** header name — `X-API-Key`, `X-Auth-Token` and similar, which is exactly what the documented `extra`-field pattern produces — stays on the session and is replayed verbatim to whatever host the redirect points at. Redirects are followed by default (`session.max_redirects = DEFAULT_REDIRECT_LIMIT`). ## What - Add `_ConnectionHeaderSession`, a `requests.Session` subclass that records which header names came from the connection and drops **only those** when `should_strip_auth()` reports the redirect is cross-origin. - Use it in `get_conn`, and populate `connection_header_keys` where the extra-field headers are applied. - Tests covering cross-host stripping, same-host preservation, caller-supplied headers being left alone, and the keys being recorded through `get_conn`. Delegating the decision to `requests`' own `should_strip_auth()` means an `https` → `http` downgrade on the same host is covered too, without duplicating that logic. ## Compatibility - Headers passed explicitly by the caller (`get_conn(headers=...)`, `default_headers`) are **not** affected — the caller controls the request either way. - Same-host redirects are unchanged. - Only connection-`extra`-derived headers are dropped, and only on a cross-origin hop. ## Testing Verified locally against real `requests`, all five cases passing: cross-host connection header dropped, same-host preserved, caller-supplied header preserved, `Authorization` still stripped by `requests` itself, and same-host `https`→`http` downgrade stripped. **The provider test suite could not be executed in my environment** — a local editable-install issue unrelated to this change prevented `airflow` from importing. `ruff check` and `ruff format --check` are clean, and `py_compile` passes on both files, but **CI needs to run `providers/http` tests.** 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
