Drop connection-supplied HTTP headers on cross-host redirects

[potiuk]

Why

HttpHook.get_conn applies every unrecognised key from a connection's extra field as a persistent session header:

session.headers.update(conn_extra_options)   # _configure_session_from_extra

and the hook's own docstring documents that field as the place to put them — "headers can also be specified in the Extra field in json format".

requests removes only the Authorization header when a redirect crosses to a different host (Session.rebuild_auth → should_strip_auth). A credential carried under any other header name — X-API-Key, X-Auth-Token and similar, which is exactly what the documented extra-field pattern produces — stays on the session and is replayed verbatim to whatever host the redirect points at. Redirects are followed by default (session.max_redirects = DEFAULT_REDIRECT_LIMIT).

What

• Add _ConnectionHeaderSession, a requests.Session subclass that records which header names came from the connection and drops only those when should_strip_auth() reports the redirect is cross-origin.
• Use it in get_conn, and populate connection_header_keys where the extra-field headers are applied.
• Tests covering cross-host stripping, same-host preservation, caller-supplied headers being left alone, and the keys being recorded through get_conn.

Delegating the decision to requests' own should_strip_auth() means an https → http downgrade on the same host is covered too, without duplicating that logic.

Compatibility

• Headers passed explicitly by the caller (get_conn(headers=...), default_headers) are not affected — the caller controls the request either way.
• Same-host redirects are unchanged.
• Only connection-extra-derived headers are dropped, and only on a cross-origin hop.

Testing

Verified locally against real requests, all five cases passing: cross-host connection header dropped, same-host preserved, caller-supplied header preserved, Authorization still stripped by requests itself, and same-host https→http downgrade stripped.

The provider test suite could not be executed in my environment — a local editable-install issue unrelated to this change prevented airflow from importing. ruff check and ruff format --check are clean, and py_compile passes on both files, but CI needs to run providers/http tests.

🤖 Generated with Claude Code

[SameerMesiah97]

Left a comment. I believe that the existing tests i.e test_get, test_get_response_check, and test_sensor are now failing as they patch Session directly when this PR is now routing the connection through _ConnectionHeaderSession. I would adjust the patching for those tests accordingly to see if it fixes the failing tests.