[Azure.Core] Do not flow token on cross-host redirect (Azure#59606)

When auto-redirect is enabled (HttpPipelineTransportOptions
 .IsClientRedirectEnabled = true, or per-message
 RedirectPolicy.SetAllowAutoRedirect), RedirectPolicy strips the
 Authorization header before following the redirect, but the per-retry
 BearerTokenAuthenticationPolicy that runs downstream unconditionally
 re-attached the cached bearer token to the redirected request --
 including when the redirect target was a different host. The result
 was that an Entra/AAD access token issued for the original service
 could be sent to any host named in the response's Location header.

 BearerTokenAuthenticationPolicy now records the request URI authority
 (host:port) it last authorized on the HttpMessage, and on re-entry
 compares it against the current authority. If the authority has
 changed (cross-host redirect):

 - Any Authorization header is removed defensively (matching
   RedirectPolicy's intent).
 - AuthorizeRequest(Async) is skipped -- no cached token is
   re-attached and the credential is not re-called.
 - The WWW-Authenticate (CAE 401) handler is also skipped -- a
   challenge issued by a redirect-target host cannot cause the
   credential to be invoked with claims derived from that host.

 Same-host redirects, normal non-redirect flow, and CAE challenges
 against the originally-authorized host remain bit-identical to today.
 RedirectPolicy itself is unchanged; its existing Authorization strip
 is retained as defense-in-depth.

 The marquee Azure cross-host redirect scenario -- Azure Container
 Registry to blob storage -- is not affected: ACR's
 ContainerRegistryChallengeAuthenticationPolicy already overrides
 AuthorizeRequest as a no-op, and blob-storage redirect targets carry
 a SAS token in the URL rather than relying on a propagated
 Authorization header. Callers who explicitly enabled auto-redirect
 AND depended on cross-host bearer-token propagation should construct
 a separate client targeting the redirect-target host with a
 credential scoped to that host's resource.

Author: jsquire

sdk/core/Azure.Core/CHANGELOG.md

@@ -8,6 +8,8 @@
 
 ### Bugs Fixed
 
+- Fixed `BearerTokenAuthenticationPolicy` so that the `Authorization` header is no longer re-attached to a request that has been redirected to a different host. Previously, `RedirectPolicy` would strip the `Authorization` header before following a redirect, but the per-retry `BearerTokenAuthenticationPolicy` would re-add the cached bearer token to the redirected request — including when the redirect target was a different host. The policy now detects when the request URI authority has changed since it last authorized the message, defensively strips any `Authorization` header, and skips both re-authorization and the `WWW-Authenticate` (CAE) `401` handler so that no bearer token is sent to — or fetched in response to a challenge from — the redirect target. Same-host redirects, normal (non-redirected) requests, and CAE handling against the original host are unchanged. Callers who explicitly enabled auto-redirect (via `HttpPipelineTransportOptions.IsClientRedirectEnabled = true` or `RedirectPolicy.SetAllowAutoRedirect(message, true)`) and depended on the bearer token being re-attached on cross-host redirects should construct a separate client targeting the redirect-target host with a credential bound to that host's resource.
+
 ### Other Changes
 
 ## 1.58.0 (2026-06-04)

sdk/core/Azure.Core/src/Pipeline/BearerTokenAuthenticationPolicy.cs

@@ -160,19 +160,52 @@ private async ValueTask ProcessAsync(HttpMessage message, ReadOnlyMemory<HttpPip
                 throw new InvalidOperationException("Bearer token authentication is not permitted for non TLS protected (https) endpoints.");
             }
 
+            // If the request URI authority has changed since this policy last authorized this
+            // message, treat the message as having been redirected to a different host. Strip
+            // any Authorization header that an earlier authorization may have left in place,
+            // and skip both re-authorization and the WWW-Authenticate (CAE) 401 handler so
+            // that no bearer token issued for the original host is sent to — or fetched in
+            // response to a challenge from — a different host.
+            var authoritySuppressed = false;
+            var currentAuthority = GetRequestAuthority(message.Request);
+
+            if (message.TryGetProperty(typeof(AuthorizedRequestAuthorityKey), out var prior)
+                && prior is string priorAuthority
+                && !string.Equals(priorAuthority, currentAuthority, StringComparison.OrdinalIgnoreCase))
+            {
+                message.Request.Headers.Remove(HttpHeader.Names.Authorization);
+                authoritySuppressed = true;
+            }
+
+            if (!authoritySuppressed)
+            {
+                if (async)
+                {
+                    await AuthorizeRequestAsync(message).ConfigureAwait(false);
+                }
+                else
+                {
+                    AuthorizeRequest(message);
+                }
+                message.SetProperty(typeof(AuthorizedRequestAuthorityKey), currentAuthority);
+            }
+
             if (async)
             {
-                await AuthorizeRequestAsync(message).ConfigureAwait(false);
                 await ProcessNextAsync(message, pipeline).ConfigureAwait(false);
             }
             else
             {
-                AuthorizeRequest(message);
                 ProcessNext(message, pipeline);
             }
 
             // Check if we have received a challenge or we have not yet issued the first request.
-            if (message.Response.Status == (int)HttpStatusCode.Unauthorized && message.Response.Headers.Contains(HttpHeader.Names.WwwAuthenticate))
+            // Only honor a WWW-Authenticate challenge against the host that we authorized; if
+            // authority changed mid-pipeline, the challenge is from an unverified target and
+            // must not trigger a credential call or a retry with an Authorization header.
+            if (!authoritySuppressed
+                && message.Response.Status == (int)HttpStatusCode.Unauthorized
+                && message.Response.Headers.Contains(HttpHeader.Names.WwwAuthenticate))
             {
                 // Attempt to get the TokenRequestContext based on the challenge.
                 // If we fail to get the context, the challenge was not present or invalid.
@@ -216,6 +249,12 @@ protected void AuthenticateAndAuthorizeRequest(HttpMessage message, TokenRequest
             message.Request.Headers.SetValue(HttpHeader.Names.Authorization, headerValue);
         }
 
+        // Composes a stable host:port string from the request URI builder without invoking
+        // ToUri(), which would throw on partially-constructed URIs. The string is intended
+        // for direct case-insensitive equality comparison, not for parsing.
+        private static string GetRequestAuthority(Request request)
+            => (request.Uri.Host ?? string.Empty) + ":" + request.Uri.Port.ToString(System.Globalization.CultureInfo.InvariantCulture);
+
         internal class AccessTokenCache
         {
             private readonly object _syncObj = new object();
@@ -491,5 +530,12 @@ public async ValueTask<AuthHeaderValueInfo> GetCurrentHeaderValue(bool async, bo
                 }
             }
         }
+
+        // Private marker used as the HttpMessage property key to record the request URI
+        // authority that this policy last authorized against. Used to detect cross-host
+        // redirects so we can suppress re-authorization of the redirected request.
+        private class AuthorizedRequestAuthorityKey
+        {
+        }
     }
 }

sdk/core/Azure.Core/tests/BearerTokenAuthenticationPolicyTests.cs

@@ -1026,6 +1026,176 @@ private static IEnumerable<object[]> CaeTestDetails()
             yield return new object[] { "multiple challenges", """PoP realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000", nonce="ey==", Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000", error_description="Continuous access evaluation resulted in challenge with result: InteractionRequired and code: TokenIssuedBeforeRevocationTimestamp", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwgInZhbHVlIjoiMTcyNjI1ODEyMiJ9fX0=" """, 200, """{"access_token":{"nbf":{"essential":true, "value":"1726258122"}}}""", "eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwgInZhbHVlIjoiMTcyNjI1ODEyMiJ9fX0=" };
         }
 
+        [Test]
+        public async Task BearerTokenAuthenticationPolicy_CrossHostRedirect_DoesNotReAttachAuthorization()
+        {
+            var callCount = 0;
+            var credential = new TokenCredentialStub((r, c) =>
+            {
+                Interlocked.Increment(ref callCount);
+                return new AccessToken("token", DateTimeOffset.UtcNow.AddHours(2));
+            }, IsAsync);
+
+            var policy = new BearerTokenAuthenticationPolicy(credential, "scope");
+
+            // MockTransport stores the Request by reference, so the Authorization header that
+            // RedirectPolicy strips before the second hop also disappears from Requests[0].
+            // Capture each request's Authorization header as it is sent.
+            var observedAuth = new List<string>();
+            var responses = new Queue<MockResponse>(new[]
+            {
+                new MockResponse(302).WithHeader("Location", "https://attacker.example/path"),
+                new MockResponse(200),
+            });
+            var transport = CreateMockTransport(req =>
+            {
+                observedAuth.Add(req.Headers.TryGetValue("Authorization", out string value) ? value : null);
+                return responses.Dequeue();
+            });
+
+            var pipeline = new HttpPipeline(transport, new HttpPipelinePolicy[] { RedirectPolicy.Shared, policy });
+
+            await SendRequestAsync(pipeline, message =>
+            {
+                message.Request.Method = RequestMethod.Get;
+                message.Request.Uri.Reset(new Uri("https://example.com/"));
+                RedirectPolicy.SetAllowAutoRedirect(message, true);
+            });
+
+            Assert.AreEqual(2, transport.Requests.Count);
+            Assert.AreEqual("https://attacker.example/path", transport.Requests[1].Uri.ToString());
+
+            Assert.AreEqual("Bearer token", observedAuth[0],
+                "Authorization header must be attached on the original-host request.");
+            Assert.IsNull(observedAuth[1],
+                "Authorization header must not be re-attached after a cross-host redirect.");
+
+            Assert.AreEqual(1, callCount,
+                "Credential must not be re-called when the redirect target host differs from the authorized host.");
+        }
+
+        [Test]
+        public async Task BearerTokenAuthenticationPolicy_SameHostRedirect_PreservesAuthorization()
+        {
+            var callCount = 0;
+            var credential = new TokenCredentialStub((r, c) =>
+            {
+                Interlocked.Increment(ref callCount);
+                return new AccessToken("token", DateTimeOffset.UtcNow.AddHours(2));
+            }, IsAsync);
+
+            var policy = new BearerTokenAuthenticationPolicy(credential, "scope");
+
+            var observedAuth = new List<string>();
+            var responses = new Queue<MockResponse>(new[]
+            {
+                new MockResponse(302).WithHeader("Location", "/redirected"),
+                new MockResponse(200),
+            });
+            var transport = CreateMockTransport(req =>
+            {
+                observedAuth.Add(req.Headers.TryGetValue("Authorization", out string value) ? value : null);
+                return responses.Dequeue();
+            });
+
+            var pipeline = new HttpPipeline(transport, new HttpPipelinePolicy[] { RedirectPolicy.Shared, policy });
+
+            await SendRequestAsync(pipeline, message =>
+            {
+                message.Request.Method = RequestMethod.Get;
+                message.Request.Uri.Reset(new Uri("https://example.com/original"));
+                RedirectPolicy.SetAllowAutoRedirect(message, true);
+            });
+
+            Assert.AreEqual(2, transport.Requests.Count);
+            Assert.AreEqual("https://example.com/redirected", transport.Requests[1].Uri.ToString());
+
+            Assert.AreEqual("Bearer token", observedAuth[0]);
+            Assert.AreEqual("Bearer token", observedAuth[1],
+                "Authorization header must be re-attached on same-host redirects.");
+
+            Assert.AreEqual(1, callCount, "Credential should be served from cache on same-host redirect.");
+        }
+
+        [Test]
+        public async Task BearerTokenAuthenticationPolicy_CaeChallengeOnOriginalHost_IsStillHandled()
+        {
+            var callCount = 0;
+            string lastClaims = null;
+            var credential = new TokenCredentialStub((r, c) =>
+            {
+                Interlocked.Increment(ref callCount);
+                lastClaims = r.Claims;
+                return new AccessToken(callCount.ToString(), DateTimeOffset.UtcNow.AddHours(2));
+            }, IsAsync);
+
+            var policy = new BearerTokenAuthenticationPolicy(credential, "scope");
+            var transport = CreateMockTransport(
+                new MockResponse(401).WithHeader(
+                    "WWW-Authenticate",
+                    """Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ==" """),
+                new MockResponse(200));
+
+            var response = await SendGetRequest(transport, policy, uri: new Uri("https://example.com/Original"));
+
+            Assert.AreEqual(200, response.Status);
+            Assert.AreEqual(2, transport.Requests.Count);
+            Assert.AreEqual(2, callCount, "CAE handler should call the credential a second time with claims.");
+            Assert.IsNotNull(lastClaims, "Second credential call should carry decoded CAE claims.");
+        }
+
+        [Test]
+        public async Task BearerTokenAuthenticationPolicy_CaeChallengeFromRedirectTargetHost_IsSuppressed()
+        {
+            var callCount = 0;
+            string lastClaims = null;
+            var credential = new TokenCredentialStub((r, c) =>
+            {
+                Interlocked.Increment(ref callCount);
+                lastClaims = r.Claims;
+                return new AccessToken("token", DateTimeOffset.UtcNow.AddHours(2));
+            }, IsAsync);
+
+            var policy = new BearerTokenAuthenticationPolicy(credential, "scope");
+
+            var observedAuth = new List<string>();
+            var responses = new Queue<MockResponse>(new[]
+            {
+                new MockResponse(302).WithHeader("Location", "https://attacker.example/path"),
+                new MockResponse(401).WithHeader(
+                    "WWW-Authenticate",
+                    """Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ==" """),
+            });
+            var transport = CreateMockTransport(req =>
+            {
+                observedAuth.Add(req.Headers.TryGetValue("Authorization", out string value) ? value : null);
+                return responses.Dequeue();
+            });
+
+            var pipeline = new HttpPipeline(transport, new HttpPipelinePolicy[] { RedirectPolicy.Shared, policy });
+
+            var message = await SendMessageRequestAsync(pipeline, msg =>
+            {
+                msg.Request.Method = RequestMethod.Get;
+                msg.Request.Uri.Reset(new Uri("https://example.com/"));
+                RedirectPolicy.SetAllowAutoRedirect(msg, true);
+            });
+
+            Assert.AreEqual(401, message.Response.Status,
+                "The 401 from a redirect-target host must surface to the caller without an authenticated retry.");
+            Assert.AreEqual(2, transport.Requests.Count,
+                "The CAE handler must not retry against a redirect-target host.");
+
+            Assert.AreEqual("Bearer token", observedAuth[0]);
+            Assert.IsNull(observedAuth[1],
+                "Authorization header must not be sent to a redirect-target host.");
+
+            Assert.AreEqual(1, callCount,
+                "Credential must not be re-called in response to a challenge from a redirect-target host.");
+            Assert.IsNull(lastClaims,
+                "Credential must not be called with CAE claims derived from a redirect-target host's challenge.");
+        }
+
         private class ChallengeBasedAuthenticationTestPolicy : BearerTokenAuthenticationPolicy
         {
             public string TenantId { get; private set; }