fix: Prevent Authentication header from being passed during cross-origin redirects (box/box-codegen#648) (#382)

Author: box-sdk-build

.codegen.json

@@ -1 +1 @@
-{ "engineHash": "ead925a", "specHash": "091b558", "version": "1.6.0" }
+{ "engineHash": "b5ed925", "specHash": "091b558", "version": "1.6.0" }

Box.Sdk.Gen/Networking/BoxNetworkClient/BoxNetworkClient.cs

@@ -105,8 +105,11 @@ async Task<FetchResponse> INetworkClient.FetchAsync(FetchOptions options)
                             throw new BoxSdkException($"Redirect response missing Location header for: {options.Url}");
                         }
 
+                        var originUri = new Uri(url);
+                        var redirectUri = new Uri(locationHeader.Value.First());
+                        var sameOrigin = originUri.Host == redirectUri.Host && originUri.Port == redirectUri.Port && originUri.Scheme == redirectUri.Scheme;
                         return await ((INetworkClient)this).FetchAsync(new FetchOptions(locationHeader.Value.First(), "GET", options.ContentType, options.ResponseFormat)
-                        { Auth = options.Auth, NetworkSession = networkSession }).ConfigureAwait(false);
+                        { Auth = sameOrigin ? options.Auth : null, NetworkSession = networkSession }).ConfigureAwait(false);
                     }
 
                     if (statusCode == 401)