PowerShell · Chris Peterson (chris-peterson) · Sep 6, 2026
@@ -554,7 +554,10 @@ protected override void ProcessRecord()
                 HttpClient client = GetHttpClient(handleRedirect);
 
                 int followedRelLink = 0;
-                Uri uri = Uri;
+
+                // Normalized so a -Uri given without a scheme has an origin to compare against.
+                Uri requestedUri = CheckProtocol(Uri);
+                Uri uri = requestedUri;
                 do
                 {
                     if (followedRelLink > 0)
@@ -567,7 +570,11 @@ protected override void ProcessRecord()
                         WriteVerbose(linkVerboseMsg);
                     }
 
-                    using (HttpRequestMessage request = GetRequest(uri, isRedirect: followedRelLink > 0))
+                    // A rel link is not a redirect, so only one that leaves the origin drops credentials.
+                    bool relLinkLeavesOrigin = followedRelLink > 0
+                        && Uri.Compare(requestedUri, uri, UriComponents.SchemeAndServer, UriFormat.UriEscaped, StringComparison.OrdinalIgnoreCase) is not 0;
+
+                    using (HttpRequestMessage request = GetRequest(uri, isRedirect: relLinkLeavesOrigin))
                     {
                         FillRequestStream(request);
                         try

@@ -3049,18 +3049,51 @@ Describe "Invoke-RestMethod tests" -Tags "Feature", "RequireAdminOnWindows" {
         1..$maxLinksToFollow | ForEach-Object { $result.Output[$_ - 1].linknumber | Should -BeExactly $_ }
     }
 
-    It "Validate Invoke-RestMethod -FollowRelLink strips the authorization header on followed relation links by default" {
-        $uri = Get-WebListenerUrl -Test 'Link' -Query @{maxlinks = 3}
+    It "Validate Invoke-RestMethod -FollowRelLink keeps the authorization header on relation links within the origin <name>" -TestCases @(
+        $originalUri = Get-WebListenerUrl -Test 'Link' -Query @{maxlinks = 3}
+        @{name = '(URI with scheme)'; uri = $originalUri}
+        @{name = '(URI without scheme)'; uri = $originalUri.OriginalString.Split("//")[1]}
+    ) {
+        param($uri)
         $command = "Invoke-RestMethod -Uri '$uri' -FollowRelLink -Headers @{Authorization = 'test'}"
         $result = ExecuteWebCommand -command $command
 
+        $result.Error | Should -BeNullOrEmpty
+        $result.Output.Count | Should -BeExactly 3
+        $result.Output[0].headers.Authorization | Should -BeExactly 'test'
+        $result.Output[1].headers.Authorization | Should -BeExactly 'test'
+        $result.Output[2].headers.Authorization | Should -BeExactly 'test'
+    }
+
+    It "Validate Invoke-RestMethod -FollowRelLink strips the authorization header on every relation link past the origin" {
+        # The second and third pages are both served by the cross-origin listener, so the third link
+        # stays stripped only if each one is compared against the requested origin rather than the
+        # link before it.
+        $crossOrigin = Get-WebListenerUrl -Https
+        $uri = Get-WebListenerUrl -Test 'Link' -Query @{maxlinks = 3; nextorigin = $crossOrigin.GetLeftPart([System.UriPartial]::Authority)}
+        $command = "Invoke-RestMethod -Uri '$uri' -FollowRelLink -SkipCertificateCheck -Headers @{Authorization = 'test'}"
+        $result = ExecuteWebCommand -command $command
+
         $result.Error | Should -BeNullOrEmpty
         $result.Output.Count | Should -BeExactly 3
         $result.Output[0].headers.Authorization | Should -BeExactly 'test'
         $result.Output[1].headers.Authorization | Should -BeNullOrEmpty
         $result.Output[2].headers.Authorization | Should -BeNullOrEmpty
     }
 
+    It "Validate Invoke-RestMethod -FollowRelLink -PreserveAuthorizationOnRedirect keeps the authorization header across origins" {
+        $crossOrigin = Get-WebListenerUrl -Https
+        $uri = Get-WebListenerUrl -Test 'Link' -Query @{maxlinks = 3; nextorigin = $crossOrigin.GetLeftPart([System.UriPartial]::Authority)}
+        $command = "Invoke-RestMethod -Uri '$uri' -FollowRelLink -PreserveAuthorizationOnRedirect -SkipCertificateCheck -Headers @{Authorization = 'test'}"
+        $result = ExecuteWebCommand -command $command
+
+        $result.Error | Should -BeNullOrEmpty
+        $result.Output.Count | Should -BeExactly 3
+        $result.Output[0].headers.Authorization | Should -BeExactly 'test'
+        $result.Output[1].headers.Authorization | Should -BeExactly 'test'
+        $result.Output[2].headers.Authorization | Should -BeExactly 'test'
+    }
+
     It "Validate Invoke-RestMethod quietly ignores invalid Link Headers if -FollowRelLink is specified: <type>" -TestCases @(
         @{ type = "noUrl" }
         @{ type = "malformed" }

@@ -78,7 +78,15 @@ public JsonResult Index()
 
             if (!skipNextLink && maxLinks > 1 && linkNumber < maxLinks)
             {
-                linkList.Add(GetLink(baseUri: baseUri, maxLinks: maxLinks, linkNumber: linkNumber + 1, type: type, whitespace: whitespace, rel: "next"));
+                // 'nextorigin' takes an absolute URI, putting the next link on another origin.
+                string nextBaseUri = baseUri;
+                if (Request.Query.TryGetValue("nextorigin", out StringValues nextOriginSV)
+                    && Uri.TryCreate(nextOriginSV.FirstOrDefault(), UriKind.Absolute, out Uri nextOrigin))
+                {
+                    nextBaseUri = new Uri(nextOrigin, new Uri(baseUri).AbsolutePath).AbsoluteUri;
+                }
+
+                linkList.Add(GetLink(baseUri: nextBaseUri, maxLinks: maxLinks, linkNumber: linkNumber + 1, type: type, whitespace: whitespace, rel: "next"));
             }
 
             StringValues linkHeader;