[venkatchalla06]

Fixes #49786.

Problem

On a cross-domain HTTP redirect, azure-core strips only the Authorization header family (RedirectPolicy.REDIRECT_HEADERS_BLACKLIST, SensitiveHeaderCleanupPolicy.DEFAULT_SENSITIVE_HEADERS). Because the credential policies re-apply their credential on every send and run downstream of the redirect policy, the credential set by AzureKeyCredentialPolicy (a custom-named header such as api-key / Ocp-Apim-Subscription-Key) and the signature appended by AzureSasCredentialPolicy are transmitted to the redirect-target host. Bearer tokens are already protected (their header is Authorization, which is stripped); this restores the same protection for the other two first-party credential policies.

Fix

Both policies now honor the same insecure_domain_change signal RedirectPolicy already sets and SensitiveHeaderCleanupPolicy already consumes:

• AzureKeyCredentialPolicy.on_request — on a cross-domain redirect, removes its custom header (the header was set on the pre-redirect request and is not re-added on the redirected send). A simple skip is insufficient because the header set before the redirect persists on the reused request object; SensitiveHeaderCleanupPolicy does not know the custom header name to strip it.
• AzureSasCredentialPolicy.on_request — on a cross-domain redirect, does not re-append the SAS (the redirected URL has already replaced the pre-redirect query).

Same-domain redirects and normal requests are unaffected.

Tests

Adds test_key_credential_withheld_after_cross_domain_redirect and test_sas_credential_withheld_after_cross_domain_redirect in tests/test_authentication.py, mirroring the existing test_auth_header_stripped_after_cross_domain_redirect* pattern (same MockTransport + pipeline order). Verified locally that the credential is withheld after a cross-domain redirect and still applied on normal requests and same-domain redirects (no over-stripping). black --line-length 120 clean.

Note: this changes authentication-logic in shared azure-core, so it likely warrants the security review called out in AGENTS.md. Opened as a draft per contributor guidance. Happy to adjust the approach — e.g. registering the credential's header name with SensitiveHeaderCleanupPolicy instead of handling it in each credential policy — if maintainers prefer the cleanup to stay centralized.

🤖 Generated with Claude Code

[github-actions]

Thank you for your contribution venkatchalla06! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
5 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.