Repository: Azure/azure-sdk-for-net
File: sdk/confidentialledger/Azure.Security.CodeTransparency/src/CodeTransparencyRedirectPolicy.cs (C#)

Code before:

            while (IsRedirectResponse(message.Response.Status))
            {
                if (++redirectCount > MaxRedirects)
                {
                    // Too many redirects; return the last redirect response as-is.
                    break;
                }

                if (!message.Response.Headers.TryGetValue("Location", out string location))
                {
                    // No Location header; return the redirect response as-is.
                    break;
                }

                Uri redirectUri = BuildRedirectUri(message.Request.Uri.ToUri(), location);

                // Disallow redirect from HTTPS to HTTP.
                if (string.Equals(message.Request.Uri.Scheme, "https", StringComparison.OrdinalIgnoreCase) &&
                    !string.Equals(redirectUri.Scheme, "https", StringComparison.OrdinalIgnoreCase))
                {
                    break;
                }

                // Update the request URI to the redirect target.
                // The Authorization header is intentionally preserved because ACL redirects
                // are between trusted nodes within the same ledger.
                message.Request.Uri.Reset(redirectUri);

                // Dispose of the redirect response before re-sending.
                message.Response.Dispose();

                if (async)
                {
                    await ProcessNextAsync(message, pipeline).ConfigureAwait(false);
                }
                else
                {
                    ProcessNext(message, pipeline);
                }
            }
        }

        private static bool IsRedirectResponse(int statusCode)
        {
            return statusCode == 307 || statusCode == 308;
        }

        private static Uri BuildRedirectUri(Uri requestUri, string location)
        {
            Uri redirectUri = new Uri(location, UriKind.RelativeOrAbsolute);

Review comment (security):
```suggestion
                // The Authorization header is intentionally preserved because CTS redirects
```

Code after:

            while (IsRedirectResponse(message.Response.Status))
            {
                if (++redirectCount > MaxRedirects)
                {
                    // Too many redirects; return the last redirect response as-is.
                    break;
                }

                if (!message.Response.Headers.TryGetValue("Location", out string location))
                {
                    // No Location header; return the redirect response as-is.
                    break;
                }

                Uri redirectUri = BuildRedirectUri(message.Request.Uri.ToUri(), location);

                // Disallow redirect from HTTPS to HTTP.
                if (string.Equals(message.Request.Uri.Scheme, "https", StringComparison.OrdinalIgnoreCase) &&
                    !string.Equals(redirectUri.Scheme, "https", StringComparison.OrdinalIgnoreCase))
                {
                    break;
                }

                // Update the request URI to the redirect target.
                // The Authorization header is intentionally preserved because CTS redirects
                // are between trusted nodes within the same ledger.
                message.Request.Uri.Reset(redirectUri);

                // Dispose of the redirect response before re-sending.
                message.Response.Dispose();

                if (async)
                {
                    await ProcessNextAsync(message, pipeline).ConfigureAwait(false);
                }
                else
                {
                    ProcessNext(message, pipeline);
                }
            }
        }

        private static bool IsRedirectResponse(int statusCode)
        {
            return statusCode == 307 || statusCode == 308;
        }

        private static Uri BuildRedirectUri(Uri requestUri, string location)
        {
            Uri redirectUri = new Uri(location, UriKind.RelativeOrAbsolute);