Do not follow redirects on a decoupled response over HTTP/2
The HTTP sender stopped following them in 75191f7752, but the HTTP/2 sender
never had the check and its async client follows redirects by default too, so
a reply endpoint answering 307 could still send the server to an address the
scheme and range checks had refused. The predicate both senders now share
lives next to those checks, as AddressingResponseEndpointPolicy is what a
redirect would otherwise walk past.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
4 files changed