By default drupal_http_request() will strip sensitive request headers (Cookie, Authorization) when following a redirect if the redirect location has a different http host to the original request, or if the scheme downgrades from https to http.
drupal_http_request() automatically follows 3xx redirects. RFC 9110 states:
When automatically following a redirected request, the user agent SHOULD resend the original request message with the following modifications:
3. Consider removing header fields that were not automatically generated by the implementation (i.e., those present in the request because they were added by the calling context) where there are security implications; this includes but is not limited to Authorization and Cookie.
See https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Sites can opt-out from this behavior by setting the drupal_http_request_strip_sensitive_headers_on_host_change or drupal_http_request_strip_sensitive_headers_on_https_downgrade variable in settings.php:
/**
* Sensitive request headers in drupal_http_request() when following a redirect.
*
* By default drupal_http_request() will strip sensitive request headers when
* following a redirect if the redirect location has a different http host to
* the original request, or if the scheme downgrades from https to http.
*
* These variables allow opting out of this behaviour. Careful consideration of
* the security implications of opting out is recommended.
*
* @see _drupal_should_strip_sensitive_headers_on_http_redirect()
* @see drupal_http_request()
*/
# $conf['drupal_http_request_strip_sensitive_headers_on_host_change'] = TRUE;
# $conf['drupal_http_request_strip_sensitive_headers_on_https_downgrade'] = TRUE;
