[MEDIUM] security: block redirects carrying custom headers

[OskarEichler]

Security impact

Custom headers are commonly used for API keys or authorization credentials. Both native implementations previously followed HTTP redirects while retaining arbitrary custom headers:

• Java HttpURLConnection strips Authorization across a host change but forwards other custom headers.
• NSURLSession HTTPAdditionalHeaders forwards both Authorization and arbitrary custom headers to redirected requests.

A cross-origin redirect from a discovery, token, or registration endpoint could therefore disclose credential-bearing headers to the redirect target. This was reproduced locally with synthetic headers and 127.0.0.1 -> localhost redirects on both platform networking stacks.

Fix

Disable automatic redirects whenever a native request carries custom headers. Android marks the connection non-following before applying headers; iOS uses a session task delegate that declines redirects for header-bearing sessions. Calls without custom headers keep their existing redirect behavior.

Blocking redirects rather than trying to classify header names is intentional: arbitrary custom headers can contain credentials, and Android HttpURLConnection has no redirect hook that can reliably scrub only a cross-origin follow-up request.

This PR is limited to redirect forwarding. Sequential Android header reuse and iOS per-call session mixing are submitted separately.

Breaking / observable changes

OAuth endpoints that redirect while custom headers are configured now fail at the redirect response. Configure the final endpoint URL directly. Requests without custom headers are unchanged.

Verification

• Android demo library compile: BUILD SUCCESSFUL
• Focused react-native-app-auth CocoaPods target build succeeds
• Existing Jest suite: 3 suites / 81 tests pass
• Existing ESLint suite passes
• git diff --check passes
• Baseline redirect harness confirmed the credential-forwarding behavior with synthetic values only

The repository has no Android or iOS native unit-test target, so the focused native changes are covered by both native compilation paths and the existing project suites. A patch changeset and documentation are included.

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

🦋 Changeset detected

Latest commit: ba541a1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
react-native-app-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR