Scenario: a synthetic token refresh for the fictional Belgavi's Book Store whose endpoint answers with a redirect. Synthetic inputs; every calculation stays in this page and nothing is sent anywhere.
Experiment workspace
Decision trace
What this lab models
One POST or GET to a token endpoint that answers with a redirect, followed once by the client you choose. The rules follow the WHATWG Fetch redirect steps, which browsers and Node.js fetch implement, and the redirect code in the Python requests library. A hand-written loop that copies the whole request and a client with redirects disabled are included for comparison. Secrets are synthetic labels. No request leaves this page.
How to experiment
Start with the defaults: Fetch, status 307, POST, a redirect to a different host and all three secrets ticked. Authorization is removed, but the X-Api-Key header and the form body with the refresh token reach the new host. Switch the status to 302 or 303 and the body is dropped because the method becomes GET. Switch the client to Python requests and compare the http to https preset, where requests keeps Authorization on default ports and Fetch removes it. Try the copy-everything loop to see every secret forwarded, and redirects disabled to see nothing sent. Edit either URL to test your own hosts and ports; editing switches the preset to custom.
Expected outcomes to check
Fetch or requests, 307 or 308, POST, different host: X-Api-Key and body delivered, Authorization removed. 301, 302 or 303 with POST: only X-Api-Key delivered, method GET. Same origin, new path: all three delivered. Same host, different port: Authorization removed by both clients. http to https on the same host with GET and Authorization: Fetch removes it, requests keeps it. Copy-everything loop: all ticked secrets delivered for every status. Redirects disabled: nothing sent.
Trace, reset and export
The trace shows the first request, the origin comparison, the method and body decision, the Authorization decision, the custom header and what was delivered. Start trace, Next step, Show all and the slider control how much of it is visible. Reset inputs restores the defaults. Export JSON records the inputs, the delivered secrets, the per-secret reasons and the full trace.
Limits
One hop only. Cookies, proxy credentials, HTTP/2 specifics, redirect limits and other client libraries are not modelled, and libraries change between versions. The Fetch and requests rules were checked against a loopback recording with requests 2.33.1 and Node.js 22.17.0 fetch for a host change; the companion code lets you rerun that probe against the clients you actually use.
Original lab by Sandeep Belgavi. Views are my own and do not represent any employer, past or present.