{"record":{"id":"bde1cae9b7422d16","repo":"conductor-oss/conductor","slug":"refusing-to-forward-credentials-across-an-api-spec","errorCode":null,"errorMessage":"Refusing to forward credentials across an API spec redirect","messagePattern":"Refusing to forward credentials across an API spec redirect","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java","lineNumber":264,"sourceCode":"            HttpRequest.Builder request =\n                    HttpRequest.newBuilder()\n                            .uri(URI.create(currentUrl))\n                            .timeout(REQUEST_TIMEOUT)\n                            .GET();\n            addHeaders(request, headers);\n            HttpResponse<byte[]> response =\n                    httpClient.send(request.build(), HttpResponse.BodyHandlers.ofByteArray());\n            if (response.statusCode() < 300 || response.statusCode() >= 400) {\n                return response;\n            }\n            String location = response.headers().firstValue(\"Location\").orElse(null);\n            if (location == null) {\n                throw new IllegalArgumentException(\n                        \"API spec redirect is missing a Location header\");\n            }\n            String target = URI.create(currentUrl).resolve(location).toString();\n            if (hasSensitiveHeaders(headers) && !isSameOrigin(currentUrl, target)) {\n                throw new IllegalArgumentException(\n                        \"Refusing to forward credentials across an API spec redirect\");\n            }\n            currentUrl = target;\n        }\n        throw new IllegalArgumentException(\"API spec exceeded the redirect limit\");\n    }\n\n    private void addHeaders(HttpRequest.Builder builder, Map<String, String> headers) {\n        if (headers == null) {\n            return;\n        }\n        headers.forEach(\n                (name, value) -> {\n                    if (name == null\n                            || value == null\n                            || name.indexOf('\\r') >= 0\n                            || name.indexOf('\\n') >= 0\n                            || value.indexOf('\\r') >= 0","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/conductor-oss/conductor/blob/cf7c3e4a8adfb158be778ab1ec525323c363cd3a/agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java#L246-L282","documentation":"Error \"Refusing to forward credentials across an API spec redirect\" thrown in conductor-oss/conductor.","triggerScenarios":"Thrown at agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java:264 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the configured auth headers, or configure the API spec URL to its final destination so no cross-origin redirect occurs."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"cf7c3e4a8adfb158be778ab1ec525323c363cd3a","analyzedAt":"2026-08-14T03:33:19.897Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}