Handling leaked OAuth Token in headers - iOS WKWebView

Question

I'm loading an URLRequest on a WKWebView with a custom header which contains our OAuth Token. The request would be redirected to a third party URL, with the OAuth Token from our end. Should we consider this as a leaked header?

Answer 1

The header containing the OAuth token will only be sent on the initial request, not on any subsequent requests or redirects.

This is both a feature and a limitation of WKWebView.

I would recommend verifying this by using a proxy (configured to support SSL proxying) e.g. Charles Proxy, to capture and review all requests and headers.