When using [axios](https://github.com/axios/axios), its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.## Steps To Reproduce & PoCTest code:```jsconst axios = require('axios');axios.get('http://127.0.0.1:10081/', { headers: { 'AuThorization': 'Rear Test', 'ProXy-AuthoriZation': 'Rear Test', 'coOkie': 't=1' }}) .then((response) => { console.log(response); })```When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.## ImpactThis vulnerability may lead to credentials leak.## RecommendationsRemove proxy-authentication header during cross-domain redirect### Recommended Patch[follow-redirects/index.js:464](https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b)```diff- removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);+ removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers);```