Hey

we have raised an issue at redpanda-data/connect#792 where the following happens

• We speak to an oAuth protected endpoint with a valid token
• Endpoint is happy with the token and redirects me to an endpoint that is secured with a X-Amz-Security-Token URL param (the oauth endpoint adds those)
• The redirected-to endpoint barfs because the initial Authorization header is still present (Message is something like "Only one auth mechanism allowed")
• The preservation of the auth headers is something that happens in the oauth2 library, doing a redirect with http.Client removes them

Now the behavior of preserving Auth headers on redirects is a somewhat grey area of the specs. I'd like to point out though that keeping auth headers is not standard golang behavior ... golang/go@6e87082 introduced a changed where Auth headers and cookies are only preserved on redirect if the target host is a subdomain.

The devs at benthos rightly said that this is something that should be fixed in the oauth library. What do you guys think? Is this a bug?