fix: do not forward Authorization/Cookie to subdomains on redirect

Closes https://github.com/dart-lang/sdk/pull/63256

GitOrigin-RevId: 1cf4d94690343b4df087e7c583154a36580fff71
Change-Id: I186e9338e36ee72714d385444e6fbf3b217ec4ff
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/498424
Commit-Queue: Slava Egorov <vegorov@google.com>
Reviewed-by: Slava Egorov <vegorov@google.com>

sdk/lib/_http/http_impl.dart

@@ -3059,11 +3059,8 @@ class _HttpClient implements HttpClient {
     );
   }
 
-  static bool _isSubdomain(Uri subdomain, Uri domain) {
-    return (subdomain.isScheme(domain.scheme) &&
-        subdomain.port == domain.port &&
-        (subdomain.host == domain.host ||
-            subdomain.host.endsWith("." + domain.host)));
+  static bool _isSameOrigin(Uri a, Uri b) {
+    return a.isScheme(b.scheme) && a.host == b.host && a.port == b.port;
   }
 
   // Only visible for testing.
@@ -3072,17 +3069,16 @@ class _HttpClient implements HttpClient {
     required Uri originalUrl,
     required Uri redirectUrl,
   }) {
-    if (_isSubdomain(redirectUrl, originalUrl)) {
-      return true;
-    }
-
-    const nonRedirectHeaders = [
+    // It is only safe to copy sensitive headers when redirecting to the
+    // same origin (RFC 6454 section 4).
+    const sensitiveHeaders = [
       "authorization",
       "www-authenticate",
       "cookie",
       "cookie2",
     ];
-    return !nonRedirectHeaders.contains(headerKey.toLowerCase());
+    return !sensitiveHeaders.contains(headerKey.toLowerCase()) ||
+        _isSameOrigin(redirectUrl, originalUrl);
   }
 
   Future<_HttpClientRequest> _openUrlFromRequest(