The v5 counterpart of #2355, plus two defects that are v5-only and are not visible in that diff.

checkRedirect had no scheme comparison. The only rejection lived in ModifyEndpointIfRedirect, which runs after client.Do has followed the whole chain, so an https to http hop had already carried the request headers to a plaintext server by the time the error was built. That check also compares only the final URL against the endpoint protocol, so https -> http -> https passed through it and returned no error at all. It is called only from advertisedReferences, never from the pack POST, so under FollowRedirects a downgraded git-upload-pack sent the credential and the request body in cleartext and also returned no error.

Separately, three error messages formatted a request URL raw, and (*url.URL).String() renders the userinfo password verbatim. One of them, (*Err).Error(), needs no redirect at all: it fires on any response NewErr does not map to a sentinel, and request URLs are built from the endpoint, which carries whatever credentials the clone URL did.

How hosts compare

Registered names fold on ASCII case only. IP literals go through netip.ParseAddr, the same call net's resolver uses to tell a literal from a name, so [::1] and [0:0:0:0:0:0:0:1] are one origin. Everything else is a different origin, including a trailing root dot and an IPv4-mapped literal against the IPv4 it dials. Both of those reach the same peer, but net/http sends the host as written in Host, so a server can route the two spellings to different virtual hosts. Same peer is not same authority.

No IDNA mapping is applied. It would only widen the equality, and go-git pins x/net in go.mod while net/http uses the copy vendored into the toolchain. The two are versioned separately, so a release that moved the Unicode tables under one and not the other would have the comparison merge origins net/http still dials apart.

ModifyEndpointIfRedirect now clears session credentials through the same predicate rather than its own host and port comparison, so the per-hop stripping and the session cannot drift apart on what an origin is. The two stay deliberately asymmetric in one respect, documented at the call site: the strip is sticky over the whole chain, while the session compares only the final URL, so an origin -> elsewhere -> origin chain can leave the discovery GET anonymous while the session's POSTs are authenticated.

Behaviour change

When a redirect leaves the repository's origin, only the headers the transport sets itself are carried over. Headers added by an AuthMethod are not, including non-credential ones such as a trace or tenant header. There is deliberately no opt-out: a caller who needs to authenticate to the origin a redirect moved the repository to can inject the credential from a RoundTripper on the *http.Client passed to NewClientWithOptions, scoped to that origin. The transport keeps its own CheckRedirect on the client it copies, so the origin checks still apply. NewClientWithOptions now documents this, along with Client.Jar, which net/http consults after CheckRedirect and which is therefore outside the stripping too.

Redirect chains that pass through plaintext http now error where https -> http -> https and http -> https -> http previously completed silently. A cross-origin redirect to a private repository now fails at the discovery GET; on servers that hide private repositories this surfaces as repository not found, and the error does not mention the redirect.

Two things move the other way. Credentials now survive a same-host http to https upgrade, which previously dropped them because the endpoint's effective port moved from 80 to 443. Hosts differing only in ASCII case are no longer separate origins. Neither is a security fix; the credential was already spent on the first plaintext request in the upgrade case.

No exported identifier is added, removed, renamed or re-signatured, and AuthMethod's method set is untouched, so this is patch-release safe.

Deliberate deviations

Git does not carry credential authentication across a host, port or scheme change, and neither does this. But http.extraHeader, which is what an AuthMethod-supplied header amounts to, is forwarded by Git to arbitrary hosts across a redirect. go-git now drops it.

A unicode hostname and its punycode are different origins here, so a redirect that only respells the host loses the credential. Git and curl keep it, because they convert to punycode when parsing the URL rather than when comparing. Normalising at parse time is the better fix, but it changes Endpoint.Host, error text and what remote.Config().URLs round-trips, so it does not belong here.

Allowing credentials across an http to https upgrade goes the other way, and departs from curl, Git and Fetch, which all count scheme as part of host identity. Auth is sent pre-emptively, so an http origin has already spent its credential in cleartext before any redirect exists.

Where this branch differs from #2355, in each case deliberately:

• The downgrade guard reuses the wording ModifyEndpointIfRedirect already produced for the same hop, so the text a caller sees for a direct downgrade is unchanged. It gains the target URL, redacted. Because the error now comes from CheckRedirect it is wrapped by net/http in a *url.Error, so equality comparisons against the old string break while substring matches still work.
• The header allowlist has five entries rather than nine. This transport never sends Git-Protocol, Cache-Control, Transfer-Encoding or Content-Encoding.
• Error messages keep the existing http redirect: prefix.
• ModifyEndpointIfRedirect is kept. Its scheme branch is now unreachable through CheckRedirect, but it is the only thing that clears the session credential, and it still covers a caller-supplied RoundTripper that follows redirects itself — which bypasses CheckRedirect, and therefore all of the stripping.
• Redaction replaces the password and leaves a username-only URL alone, matching plumbing: transport/http, Compare origins when following redirects #2355.

Request URLs also reach an error before any of this, without being parsed: Endpoint.String() re-emits Endpoint.Path raw, so a path holding a stray percent builds a string url.Parse rejects and reports verbatim. Only http.Client redacts, and only errors it raises itself, so the three http.NewRequest calls go through a wrapper that redacts what url.Parse hands back. A redirect Location can install such a path on the session, and a clone URL can carry one directly.

Tests

The origin comparison, including hosts where Unicode case-folding would merge two names that resolve to different servers; the redaction helpers and all six sites that reach them; redirects within and across an origin; multi-hop chains and the sticky decision; interaction with a caller-supplied CheckRedirect; the header allowlist pinned by membership so widening it has to be deliberate; and a redirected git-upload-pack POST on both sides of the origin boundary under RedirectPolicy: "true", where a 307 preserves method and body.

The downgrade is covered end to end with split DialContext and DialTLSContext, so the assertion is that the plaintext listener was never dialled rather than that the URL looked wrong.