Fix: strip sensitive headers on redirect to different origin

[rexxars]

I originally sent a PR for this as #271, but it fixed a number of issues related to the redirect handling which could be considered breaking - and also added a dependency. After giving @joeybaker's review some thought, I am really eager to get a patch release out for this issue, as I don't want to leave the entire 2.x range with a security issue.

This PR attempts to address only the security issue, and does so in a way that should be backwards compatible. I still think we should improve the redirect handling overall, so I have renamed #271 to be more descriptive about this.

In other words, I want to merge this PR first, release a patch release on the 2.x range (potentially also backporting it to 1.x). Later on, I want to merge #271 and do a major release for that - but there is no rush with that one.

[joeybaker]

A few minor suggestions for you, but this seems to do the thing. Ironic how much more code it is :P

[MatanBobi]

Hi @rexxars! Thanks for the hard work on this one.
I saw you published v1.1.1 also. Does that mean you backported this fix to support 1.x too? I'm asking because Snyk and the vulnerabilities database say to upgrade to version 2.

Thanks again :)

[rexxars]

Hi @rexxars! Thanks for the hard work on this one. I saw you published v1.1.1 also. Does that mean you backported this fix to support 1.x too? I'm asking because Snyk and the vulnerabilities database say to upgrade to version 2.

Thanks again :)

Yes, I backported it to 1.1.1 in case people are still on 1.x and cannot upgrade for some reason. Generally we don't maintain the 1.x range any longer, but felt like patching this was worthwhile.

[MatanBobi]

Yes, I backported it to 1.1.1 in case people are still on 1.x and cannot upgrade for some reason. Generally we don't maintain the 1.x range any longer, but felt like patching this was worthwhile.

Thanks for thinking about that :)
I reached out to both Snyk and the vulnerabilities database to update that 1.1.1 also contains a fix.