From f440573c3eaeadd043b1b17fbbf7203ea00b06e2 Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Thu, 8 Oct 2026 23:20:27 +0100
Subject: [PATCH] rest: fix TestStripHeadersOnCrossHostRedirectFn failing on
 go1.26

Before go1.27 net/http compares hosts case sensitively when deciding
whether to keep Authorization on a redirect, so it dropped the header
itself on the localhost -> LOCALHOST redirect in the
SameHostDifferentCase test, before StripHeadersOnCrossHostRedirectFn
was consulted. The other headers still show the function treats the
hosts as the same.
---
 lib/rest/rest_test.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/rest/rest_test.go b/lib/rest/rest_test.go
index cb689388b..3d4351fe2 100644
--- a/lib/rest/rest_test.go
+++ b/lib/rest/rest_test.go
@@ -386,6 +386,9 @@ func TestStripHeadersOnCrossHostRedirectFn(t *testing.T) {
 				require.NoError(t, err)
 				http.Redirect(w, r, "http://LOCALHOST:"+u.Port()+"/redirected", http.StatusTemporaryRedirect)
 			case "/redirected":
+				// Before go1.27 net/http compares hosts case
+				// sensitively and drops Authorization itself here.
+				r.Header.Set("Authorization", stripTestHeaders["Authorization"])
 				assertKept(r)
 				w.WriteHeader(http.StatusOK)
 			default: