Do not send headers after following redirection

CHANGELOG.md

@@ -16,9 +16,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ### Removed
 
 ### Fixed
+
+ * [Core] Do not send headers after following redirection.
+   ([#1475-cucumber-ruby](https://github.com/cucumber/cucumber-ruby/pull/1475)
+    [#2144](https://github.com/cucumber/cucumber-jvm/pull/2144))
  * [Core] Mention `junit-platform.properties` in `--publish` banner. ([#2117](https://github.com/cucumber/cucumber-jvm/pull/2117) M.P. Korstanje)
  * [Core] `--publish` uses banner provided by server. ([#2117](https://github.com/cucumber/cucumber-jvm/pull/2117) M.P. Korstanje)
- 
+
 ## [6.8.0] (2020-09-26)
 
 ### Added
@@ -34,7 +38,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ## [6.7.0] (2020-09-14)
 
 ### Added
- * [JUnit Platform] Support discovery selectors with FilePosition ([#2121](https://github.com/cucumber/cucumber-jvm/pull/2121) M.P. Korstanje) 
+ * [JUnit Platform] Support discovery selectors with FilePosition ([#2121](https://github.com/cucumber/cucumber-jvm/pull/2121) M.P. Korstanje)
 
 ### Changed
  * [JUnit Platform] Update dependency org.junit.platform:junit-platform-engine to v1.7.0

core/src/main/java/io/cucumber/core/plugin/UrlOutputStream.java

@@ -60,40 +60,50 @@ public void flush() throws IOException {
     @Override
     public void close() throws IOException {
         tempOutputStream.close();
-        sendRequest(option.getUri().toURL(), option.getMethod())
+        sendRequest(option.getUri().toURL(), option.getMethod(), true)
                 .ifPresent(redirectResponse -> {
                     if (urlReporter != null) {
                         urlReporter.report(redirectResponse);
                     }
                 });
     }
 
-    private Optional<String> sendRequest(URL url, HttpMethod method) throws IOException {
+    private Optional<String> sendRequest(URL url, HttpMethod method, boolean setHeaders) throws IOException {
         HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();
-        for (Entry<String, String> header : option.getHeaders()) {
-            urlConnection.setRequestProperty(header.getKey(), header.getValue());
+        if(setHeaders) {
+            for (Entry<String, String> header : option.getHeaders()) {
+                urlConnection.setRequestProperty(header.getKey(), header.getValue());
+            }
         }
         Map<String, List<String>> requestHeaders = urlConnection.getRequestProperties();
         urlConnection.setInstanceFollowRedirects(true);
         urlConnection.setRequestMethod(method.name());
         String redirectMessage = null;
         if (method == CurlOption.HttpMethod.GET) {
-            redirectMessage = throwExceptionIfUnsuccessful(urlConnection, requestHeaders);
+            redirectMessage = getResponseBody(urlConnection, requestHeaders);
             String location = urlConnection.getHeaderField("Location");
             if (urlConnection.getResponseCode() == 202 && location != null) {
-                sendRequest(new URL(location), CurlOption.HttpMethod.PUT);
+                sendRequest(new URL(location), CurlOption.HttpMethod.PUT, false);
             }
         } else {
             urlConnection.setDoOutput(true);
             try (OutputStream outputStream = urlConnection.getOutputStream()) {
                 Files.copy(temp, outputStream);
-                throwExceptionIfUnsuccessful(urlConnection, requestHeaders);
+                getResponseBody(urlConnection, requestHeaders);
             }
         }
         return Optional.ofNullable(redirectMessage);
     }
 
-    private static String throwExceptionIfUnsuccessful(
+    /**
+     * return the request body
+     *
+     * @param urlConnection the http connection
+     * @param requestHeaders the headers sent
+     * @return the response body
+     * @throws IOException if an exception occurs
+     */
+    private static String getResponseBody(
             HttpURLConnection urlConnection, Map<String, List<String>> requestHeaders
     )
             throws IOException {

core/src/test/java/io/cucumber/core/plugin/UrlOutputStreamTest.java

@@ -26,6 +26,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.nullValue;
 
 @ExtendWith({ VertxExtension.class })
 public class UrlOutputStreamTest {
@@ -87,11 +88,11 @@ void it_sends_the_body_twice_for_307_redirect_with_put(Vertx vertx, VertxTestCon
     }
 
     @Test
-    void it_sends_the_body_once_for_202_and_location_with_get(Vertx vertx, VertxTestContext testContext)
+    void it_sends_the_body_once_for_202_and_location_with_get_without_token(Vertx vertx, VertxTestContext testContext)
             throws Exception {
         String requestBody = "hello";
         TestServer testServer = new TestServer(port, testContext, requestBody, HttpMethod.PUT, null, null, 200, "");
-        CurlOption url = CurlOption.parse(format("http://localhost:%d/accept -X GET", port));
+        CurlOption url = CurlOption.parse(format("http://localhost:%d/accept -X GET -H 'Authorization: Bearer s3cr3t'", port));
         verifyRequest(url, testServer, vertx, testContext, requestBody);
 
         assertThat(testContext.awaitCompletion(TIMEOUT_SECONDS, TimeUnit.SECONDS), is(true));
@@ -218,6 +219,8 @@ public void start(Promise<Void> startPromise) {
                     assertThat(ctx.request().method(), is(equalTo(expectedMethod)));
                     assertThat(ctx.request().query(), is(equalTo(expectedQuery)));
                     assertThat(ctx.request().getHeader("Content-Type"), is(equalTo(expectedContentType)));
+                    // We should never send the Authorization header.
+                    assertThat(ctx.request().getHeader("Authorization"), is(nullValue()));
 
                     ctx.request().handler(receivedBody::appendBuffer);
                     ctx.request().endHandler(e -> {