CVE-2024-1968

In scrapy/scrapy, an issue was identified where the Authorization header is
not removed during redirects that only change the scheme (e.g., HTTPS to
HTTP) but remain within the same domain. This behavior contravenes the
Fetch standard, which mandates the removal of Authorization headers in
cross-origin requests when the scheme, host, or port changes. Consequently,
when a redirect downgrades from HTTPS to HTTP, the Authorization header may
be inadvertently exposed in plaintext, leading to potential sensitive
information disclosure to unauthorized actors. The flaw is located in the
_build_redirect_request function of the redirect middleware.