[Regression]: `route.continue` now maintains headers through redirects which does not match documentation

[johnharringt0n]

Last Good Version

1.40.1

First Bad Version

1.41.0

Steps to reproduce

The reproduction steps are in Playwright's existing test suite. You can see the added test in #28771.

The PR with the breaking change was #28962

Expected behavior

In Playwright's documentation, it says route.continue does not pass along headers for redirects

playwright/docs/src/api/class-route.md

Line 105 in 8715652

Note that any overrides such as [`option: url`] or [`option: headers`] only apply to the request being routed. If this request results in a redirect, overrides will not be applied to the new redirected request. If you want to propagate a header through redirects, use the combination of [`method: Route.fetch`] and [`method: Route.fulfill`] instead.

Actual behavior

After #28962 , Playwright does pass along all initial headers to any redirects triggered from route.continue.

This breaks our E2E tests when sending pre-signed requests to S3. Our E2E test flow is:

• A request is sent from the frontend client to our server. This request is intercepted with Playwright's .route('**/*') and an Authorization header is added with the user's bearer token.
• The request is received by our server where it generates a presigned S3 URL with a Signature query param and it strips the Authorization header from the request before returning a 302 redirect

Previously, this had no issue when running in Playwright as the Authorization header would only be added to the initial request as expected.

After the changes in #28962, our E2E tests can no longer load data from S3. Since Playwright auto-injects the original headers into all redirect requests as well, the redirected request to S3 fails with an error

<?xml version="1.0" encoding="UTF-8"?>
<Error>
  <Code>
    InvalidArgument
  </Code>
  <Message>
    Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specified
  </Message>
  <ArgumentName>
    Authorization
  </ArgumentName>
  <ArgumentValue>
    Bearer (our user's bearer token)
  </ArgumentValue>
  <RequestId>
    (the request ID)
  </RequestId>
  <HostId>
     (our host ID)
  </HostId>
</Error>

When the feature was initially requested for route.continue() to carry headers through redirects (#28758), it was proposed to do so via a specific property, e.g.

page.continue({
  headers: {
    'Test-Metadata': testMetadata,
  },
  propagetHeadersToRedirects: true,
});

This request is to change the current behavior to allow opting out (e.g. propogateHeadersToRedirects: false) as right now Playwright does not expose the request during the redirects so there's no way to strip or modify the headers after the initial request.

Additional context

No response

Environment

System:
    OS: Linux 6.2 Ubuntu 22.04.5 LTS 22.04.5 LTS (Jammy Jellyfish)
    CPU: (8) x64 Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
    Memory: 24.91 GB / 62.01 GB
    Container: Yes
  Binaries:
    Node: 10.15.3 - ~/.nvm/versions/node/v10.15.3/bin/node
    npm: 10.1.0 - ~/av/tools/bin/npm
  IDEs:
    VSCode: 1.93.1 - /home/john/.vscode-server/cli/servers/Stable-38c31bc77e0dd6ae88a4e9cc93428cc27a56ba40/server/bin/remote-cli/code
  Languages:
    Bash: 5.1.16 - /usr/bin/bash

[yury-s]

The behavior in the browser depends on the header and on the fetch parameters (such as credentials). Currently Playwright propagates the overridden header along with the following redirects. To have a fine grain control over which headers are sent, you can intercept the request that is going to be redirected, fetch the result manually and then continue with the redirected url and remove:

  await page.route('**/redirect', async route => {
    const response = await route.fetch({
      maxRedirects: 0,
      headers: {
        ...route.request().headers(),
        authorization: 'credentials',
      }
    });
    await route.continue({
      url: response.headers().location,
    });
  });