From da19d0208357e35980b9df0a6121551db0da2605 Mon Sep 17 00:00:00 2001
From: "Treicy Sanchez Gutierrez (from Dev Box)" <treicys@microsoft.com>
Date: Thu, 23 Jul 2026 10:11:24 -0600
Subject: [PATCH 1/2] docs(kiota): document scrubbing custom sensitive headers
 on redirects

---
 OpenAPI/kiota/middleware.md | 53 +++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/OpenAPI/kiota/middleware.md b/OpenAPI/kiota/middleware.md
index 9cdfe78..13c2490 100644
--- a/OpenAPI/kiota/middleware.md
+++ b/OpenAPI/kiota/middleware.md
@@ -166,3 +166,56 @@ The following table describes which middleware handlers are implemented by the H
 
 > [!NOTE]
 > Request body decompression is not enabled by default in ASP.NET Core APIs and needs to be enabled. Find out how to enable it with [Request Decompression in ASP.NET core](/aspnet/core/fundamentals/middleware/request-decompression).
+
+## Scrubbing sensitive headers on redirects
+
+When the Redirect handler follows a redirect to a different origin (a change of host, scheme, or port), it removes well-known credential headers so they aren't leaked to an untrusted target. By default, the handler removes the `Authorization` and `Cookie` headers (and, where applicable, `Proxy-Authorization`).
+
+> [!IMPORTANT]
+> Only the standard `Authorization`, `Cookie`, and `Proxy-Authorization` headers are scrubbed by default. Custom credential headers, such as API keys (for example `X-Api-Key`, `api-key`, or `Ocp-Apim-Subscription-Key`), are **not** removed automatically. Scrubbing a custom API key or authorization header on redirect is the consumer's responsibility, using the redirect option's sensitive-headers callback described below.
+
+To remove your own custom headers, provide a sensitive-headers callback on the redirect option that removes the header when the origin changes.
+
+### [.NET](#tab/csharp)
+
+```csharp
+var redirectOption = new RedirectHandlerOption
+{
+    ScrubSensitiveHeaders = (request, originalUri, proxyResolver) =>
+    {
+        // Keep the default scrubbing of Authorization, Cookie, and Proxy-Authorization.
+        RedirectHandlerOption.DefaultScrubSensitiveHeaders(request, originalUri, proxyResolver);
+
+        // Remove your custom API key header on redirect.
+        request.Headers.Remove("X-Api-Key");
+    }
+};
+
+var handlers = KiotaClientFactory.CreateDefaultHandlers(new IRequestOption[] { redirectOption });
+```
+
+### [Python](#tab/python)
+
+```python
+from kiota_http.kiota_client_factory import KiotaClientFactory
+from kiota_http.middleware.options.redirect_handler_option import (
+    RedirectHandlerOption,
+    default_scrub_sensitive_headers,
+)
+
+
+def scrub_sensitive_headers(new_request, original_url):
+    # Keep the default scrubbing of Authorization and Cookie.
+    default_scrub_sensitive_headers(new_request, original_url)
+
+    # Remove your custom API key header on redirect.
+    new_request.headers.pop("X-Api-Key", None)
+
+
+redirect_option = RedirectHandlerOption(scrub_sensitive_headers=scrub_sensitive_headers)
+middleware = KiotaClientFactory.get_default_middleware(
+    {RedirectHandlerOption.get_key(): redirect_option}
+)
+```
+
+---

From ea7328a2239f74a16782e9288480a595d65dc640 Mon Sep 17 00:00:00 2001
From: "Treicy Sanchez Gutierrez (from Dev Box)" <treicys@microsoft.com>
Date: Thu, 23 Jul 2026 17:57:23 -0600
Subject: [PATCH 2/2] docs(kiota): add TypeScript tab to fix tab group id
 warning

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 491d68b0-7a24-4232-8f74-20c999805600
---
 OpenAPI/kiota/middleware.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/OpenAPI/kiota/middleware.md b/OpenAPI/kiota/middleware.md
index 13c2490..b8ba392 100644
--- a/OpenAPI/kiota/middleware.md
+++ b/OpenAPI/kiota/middleware.md
@@ -194,6 +194,11 @@ var redirectOption = new RedirectHandlerOption
 var handlers = KiotaClientFactory.CreateDefaultHandlers(new IRequestOption[] { redirectOption });
 ```
 
+### [TypeScript](#tab/typescript)
+
+> [!NOTE]
+> A composable way to remove custom headers while preserving the built-in scrubbing isn't available yet in the TypeScript library, because the default scrubbing implementation isn't exposed for reuse. Until then, avoid attaching custom API key or authorization headers to requests that can be redirected across origins.
+
 ### [Python](#tab/python)
 
 ```python