Thanks for the report.

/cc @bradfitz

From my reading, libcurl's behavior is to keep sensitive headers only when the hostname is an exact match (ignoring the port).

I think that if we're going to preserve a header on a redirect from example.com to foo.example.com, then there's no reason not to preserve it on a redirect from one port to another on the same host. (Perhaps we should refuse to copy headers on a security downgrade from https to http?)

If the sensitive headers can be copied for subdomains then why not for the same host without a port.

I expect the headers to be copied to the same host of the different ports.

Redirecting from api.gopherhut.com:80 to api.gopherhut.com:443 I expect the sensitive headers also should be sent.
Currently, this is not happening because we are checking for exact host matches from the different canonical host addresses.

func isDomainOrSubdomain(sub, parent string) bool {
	if sub == parent {
		return true
	}
	// If sub is "foo.example.com" and parent is "example.com",
	// that means sub must end in "."+parent.
	// Do it without allocating.
	if !strings.HasSuffix(sub, parent) {
		return false
	}
	return sub[len(sub)-len(parent)-1] == '.'
}

Yes, agree with what @manigandand said
Maybe we should just simply check the hostnames and leave out the ports when doing the check

Hello, the problem still occurs using go1.17.2 .
Want to know if there are any updates on this issue?

Hello, the problem still occurs using go1.18. I submit a pr to fix it.

Change https://go.dev/cl/417014 mentions this issue: net/http: copy Authorization header when redirect from http to https Fixes #35104

Change https://go.dev/cl/424935 mentions this issue: net/http: keep sensitive headers on redirects to the same domain - Fixes #35104

@wubin1989 : Your change is removing ports 80 and 443 from a map that is used in the canonicalAddr function, which must always return host:port. If those ports are not present on this map, it will return host:. This function is also used in other structs of the net/http package (like Transport) which I think require the port.

I've created another PR which basically keeps that function untouched and adds another one that returns only the host. I've also updated some of the original tests which were assuming that redirects to the same host + different port shouldn't propagate these headers: #54539