Drop connection headers on cross-host redirect in HttpAsyncHook (#70164)

[waterWang]

Summary

HttpAsyncHook forwards Connection extra headers (e.g. X-API-Key, Private-Token) across cross-host redirects because aiohttp only strips the Authorization header. This is a security issue — a secret held under any other header name is replayed verbatim to the redirect target.

PR #70000 fixed the synchronous HttpHook by subclassing requests.Session and extending rebuild_auth. This PR fixes the async side.

Approach

aiohttp has no per-redirect callback equivalent to requests.Session.rebuild_auth(), so the fix disables automatic redirect following (allow_redirects=False) and walks the redirect chain manually. When the redirect target changes host, connection-supplied headers are dropped from subsequent requests. Same-host redirects are unaffected.

Changes

1. providers/http/src/airflow/providers/http/hooks/http.py — AsyncHttpSession.run() now handles redirects manually:

   • Tracks which headers originated from the connection
   • Disables aiohttp's auto-redirect
   • On cross-host redirect: drops connection headers, keeps caller-supplied headers
   • On same-host redirect: retains all headers
   • Max 5 redirects followed (matching requests default)

2. devel-common/src/tests_common/test_utils/aiohttp.py — Added headers and release() to MockAiohttpClientResponse to support redirect tests.

3. providers/http/tests/unit/http/hooks/test_http.py — Added test_async_connection_header_is_only_forwarded_on_a_same_host_redirect parametrized for cross-host and same-host redirects.

Verification

• Cross-host redirect: X-API-Key present on first request, absent on second
• Same-host redirect: X-API-Key present on both requests
• Existing tests pass unchanged

Related

• Fixes HttpAsyncHook replays connection extra headers across a cross-host redirect #70164
• Sync hook fix: Strip connection headers on cross-host redirect in HttpHook #70000