fix: keep API keys within the request origin (#1021)

## Summary

Keep `api-key` headers within the original request origin when following
redirects.

## Changes

- Remove `api-key` from redirected requests when the destination scheme,
hostname, or port differs from the original request.
- Preserve the header for same-origin requests and redirects.

## Compatibility

This changes cross-origin redirect behavior for all `api-key` headers,
including manually supplied headers; it is not limited to Azure
authentication. A redirected destination that requires the forwarded key
may now reject the request.

Applications relying on this behavior should configure the authenticated
destination directly or have their gateway proxy upstream instead of
redirecting the client across origins. Same-origin redirects are
unaffected.

This change is intended for a minor release under the documented
semantic-versioning exception for changes not expected to affect the
vast majority of users.

Co-authored-by: dpiet-oai <326640584+dpiet-oai@users.noreply.github.com>

Author: dpiet-oai

.castiron.stats.yml

@@ -1,8 +1,8 @@
 schema_version: 1
-generation_id: 83660139-66f0-496d-b857-53e5c96b385e
+generation_id: e6bf81c1-895b-4eed-bda4-d3713d677592
 openapi_spec_hash: 12fb4f3ab9b96e5acefc54dceacd92cc
 openapi_transformed_spec_hash: 336279ed1cb704ff922280d0ae0b4470
 config_hash: 6b3cc69eb8ac6b5a19e4f865bb7e93fa
-codegen_sha: edc29b00bf8f69227852ab87f3f8deb05ef3919c
+codegen_sha: 4e8acd224e751c0577180c9f4cae262f52643e17
 codegen_hash: e4e4a0e129b97287ab79d7a523334642e9b12e96d1d48171103929b19aa0fbba
-public_codegen_sha: 1b62f8f4f8ad50a2a1b423f302b3f7d7d28baa0c
+public_codegen_sha: 770860394e8ddd3ef6786450011bfc909df3129f

openai-java-client-okhttp/src/main/kotlin/com/openai/client/okhttp/OkHttpClient.kt

@@ -184,6 +184,21 @@ internal constructor(@JvmSynthetic internal val okHttpClient: okhttp3.OkHttpClie
                     .retryOnConnectionFailure(false)
                     .followRedirects(followRedirects)
                     .followSslRedirects(followRedirects)
+                    .addNetworkInterceptor { chain ->
+                        val request = chain.request()
+                        val originalUrl = chain.call().request().url
+                        val url = request.url
+                        val sameOrigin =
+                            originalUrl.scheme == url.scheme &&
+                                originalUrl.host == url.host &&
+                                originalUrl.port == url.port
+                        // OkHttp strips Authorization on cross-origin redirects, but does not
+                        // recognize the Azure API-key header as a credential.
+                        chain.proceed(
+                            if (sameOrigin) request
+                            else request.newBuilder().removeHeader("api-key").build()
+                        )
+                    }
                     .connectTimeout(timeout.connect())
                     .readTimeout(timeout.read())
                     .writeTimeout(timeout.write())

openai-java-client-okhttp/src/test/kotlin/com/openai/client/okhttp/RedirectCredentialBoundaryTest.kt

@@ -0,0 +1,104 @@
+package com.openai.client.okhttp
+
+import com.openai.core.RequestOptions
+import com.openai.core.http.HttpMethod
+import com.openai.core.http.HttpRequest
+import java.util.concurrent.TimeUnit
+import okhttp3.mockwebserver.MockResponse
+import okhttp3.mockwebserver.MockWebServer
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.Test
+
+internal class RedirectCredentialBoundaryTest {
+
+    @Test fun crossOriginRedirectDoesNotForwardAzureApiKey() = checkCrossOriginRedirect(false)
+
+    @Test fun asyncCrossOriginRedirectDoesNotForwardAzureApiKey() = checkCrossOriginRedirect(true)
+
+    private fun checkCrossOriginRedirect(async: Boolean) {
+        MockWebServer().use { origin ->
+            MockWebServer().use { destination ->
+                origin.enqueue(
+                    MockResponse()
+                        .setResponseCode(302)
+                        .setHeader("Location", destination.url("/redirected"))
+                )
+                destination.enqueue(MockResponse().setBody("ok"))
+                val request = request(origin)
+
+                OkHttpClient.builder().build().use { client ->
+                    val response =
+                        if (async) {
+                            client
+                                .executeAsync(request, RequestOptions.none())
+                                .get(5, TimeUnit.SECONDS)
+                        } else {
+                            client.execute(request, RequestOptions.none())
+                        }
+                    response.use { assertThat(it.statusCode()).isEqualTo(200) }
+                }
+
+                assertThat(origin.takeRequest(5, TimeUnit.SECONDS)?.getHeader("api-key"))
+                    .isEqualTo("test-azure-key")
+                val redirected = destination.takeRequest(5, TimeUnit.SECONDS)
+                assertThat(redirected).isNotNull()
+                assertThat(redirected?.getHeader("api-key")).isNull()
+                assertThat(redirected?.getHeader("X-Test")).isEqualTo("retained")
+            }
+        }
+    }
+
+    @Test
+    fun sameOriginRedirectKeepsAzureApiKey() {
+        MockWebServer().use { origin ->
+            origin.enqueue(MockResponse().setResponseCode(302).setHeader("Location", "/redirected"))
+            origin.enqueue(MockResponse().setBody("ok"))
+
+            OkHttpClient.builder().build().use { client ->
+                client.execute(request(origin), RequestOptions.none()).close()
+            }
+
+            assertThat(origin.takeRequest(5, TimeUnit.SECONDS)?.getHeader("api-key"))
+                .isEqualTo("test-azure-key")
+            assertThat(origin.takeRequest(5, TimeUnit.SECONDS)?.getHeader("api-key"))
+                .isEqualTo("test-azure-key")
+        }
+    }
+
+    @Test
+    fun redirectChainKeepsCredentialsWithinOriginalOrigin() {
+        MockWebServer().use { origin ->
+            MockWebServer().use { destination ->
+                origin.enqueue(
+                    MockResponse()
+                        .setResponseCode(302)
+                        .setHeader("Location", destination.url("/redirected"))
+                )
+                destination.enqueue(
+                    MockResponse()
+                        .setResponseCode(302)
+                        .setHeader("Location", origin.url("/returned"))
+                )
+                origin.enqueue(MockResponse().setBody("ok"))
+
+                OkHttpClient.builder().build().use { client ->
+                    client.execute(request(origin), RequestOptions.none()).close()
+                }
+
+                origin.takeRequest(5, TimeUnit.SECONDS)
+                assertThat(destination.takeRequest(5, TimeUnit.SECONDS)?.getHeader("api-key"))
+                    .isNull()
+                assertThat(origin.takeRequest(5, TimeUnit.SECONDS)?.getHeader("api-key"))
+                    .isEqualTo("test-azure-key")
+            }
+        }
+    }
+
+    private fun request(origin: MockWebServer): HttpRequest =
+        HttpRequest.builder()
+            .method(HttpMethod.GET)
+            .baseUrl(origin.url("/original").toString())
+            .putHeader("Api-Key", "test-azure-key")
+            .putHeader("X-Test", "retained")
+            .build()
+}