[yovanoc]

Summary

same origin     → retain caller Authorization / Cookie
cross origin    → drop caller credentials; select destination jar cookies
return hop      → do not resurrect caller credentials; select current jar
independent fetch → original instance defaults remain available

The JavaScript redirect loop reuses request headers for every hop. Native constructor defaults can also reappear when the redirect request omits those headers. This forwards caller-supplied Authorization and raw Cookie headers to another origin.

Track whether the fetch has crossed an origin, filter those two request headers case-insensitively, and shadow native defaults using the existing empty-value omission semantics. Keep cookie-jar lookup/persistence per hop and do not mutate the caller's header arrays or instance defaults. No Rust, dependency, API, or release/version changes.

Evidence

• Before: all three added native loopback regressions fail on current master: the destination receives the original request or constructor-default credentials.
• After: pnpm exec vitest run test/redirect-credentials.test.ts test/cookies.test.ts --retry=0 — 24 passed (3 new regressions + 21 existing cookie tests).
• The tests cover same-origin retention, mixed-case headers, constructor defaults with/without a jar, destination cookie renewal, return hops, nonmutation, and later independent fetches. Only loopback servers and dummy credentials; owned sockets/server are closed and asserted.
• New test imports the public package entry point, exercising this wrapper with the installed published 0.14.6 Darwin arm64 native binding. It also passes pnpm exec tsc --noEmit --module nodenext --moduleResolution nodenext --target es2022 --skipLibCheck --types node test/redirect-credentials.test.ts.
• git diff --check passes. Full Rust rebuild, remote fingerprint/e2e tests and other platforms were not run locally.

Merge Danger

Door: two-way; JavaScript wrapper change only.

Blast Radius: redirects.

Callers relying on cross-origin forwarding of explicit/default credentials will observe stricter behavior. Destination-scoped jar cookies still work; same-origin redirects and fresh independent fetches retain their existing credentials. Empty suppression values are consumed by the native header builder, not sent as empty HTTP headers.

[barjin]

lgtm, thanks @yovanoc, this matches what Node's own fetch does on cross-origin redirects 👍