How to remove authorization header in a http 302 response

Question

I am using Java / Jersy Framework(Tomcat) for REST API development. One such web service's functionality is to redirect(HTTP 302) to a S3 signed URL for a file. we use "Authorization" header to check the request's validity. When this web service is invoked the service generates a signed url with signature and redirect to the signed Url.

Java Code from REST Web Service (uri is the signed url)

return Response.status(HttpStatus.SCMOVEDTEMPORARILY).location(uri).build();

When the redirection happens the Authorization header is also passed along with the signature. Since Amazon accepts either Authorization or Signature in signed URL but not both it throws an error as below from Amazon S3..

Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specified

Is there a way to remove this header being send while redirection happens ...

I tried adding a filter and which overrides the ServletResponse with a custom HttpServletResponseWrapper implementation and logged the header names in both addHeader and setHeader methods. It never calls this method for Authorization header.

Modified code as to set header as nulll or "" both did not work ..

return Response.status(HttpStatus.SCMOVEDTEMPORARILY).location(uri).header("Authorization",null).build();
return Response.status(HttpStatus.SCMOVEDTEMPORARILY).location(uri).header("Authorization","").build();

Answer 1

Basically, the redirect response does not have any "Authorization" headers, the "Authorization" header is only part of the request. So this is normal behavior for any HTTP client to resend all the headers to redirect location which they have sent to the original URL. There is nothing that you can do here. But most of the HTTP clients will resend the "Authorization" header only if the redirect location is on the same domain/origin. In your case, you can try to create a separate domain for S3 URL and redirect to it and hope that clients HTTP client will drop "Authorization" header when it will detect that the domain is changed (that's a security issue to resend an "Authorization" header when following redirect to a new domain/origin).