Patched code sample

import requests
from urllib.parse import urljoin, urlparse

def fetch(url, headers=None, max_redirects=5):
    """
    A simplified representation of linuxfabrik-lib.url.fetch,
    manually handling redirects.
    """
    current_url = url
    current_headers = headers or {}
    sensitive_headers_lower = {'x-auth-token', 'x-api-key'}

    for _ in range(max_redirects):
        response = requests.get(
            current_url,
            headers=current_headers,
            allow_redirects=False,
            timeout=10,
        )

        if not response.is_redirect:
            return response

        redirect_url = response.headers.get('Location')
        if not redirect_url:
            return response

        new_url = urljoin(current_url, redirect_url)

        original_origin = urlparse(current_url)
        new_origin = urlparse(new_url)
        # FIX: On cross-origin redirects, sensitive headers are stripped before the next request.
        if (original_origin.scheme, original_origin.hostname, original_origin.port) != \
           (new_origin.scheme, new_origin.hostname, new_origin.port):
            current_headers = {
                k: v for k, v in current_headers.items()
                if k.lower() not in sensitive_headers_lower
            }

        current_url = new_url

    raise requests.exceptions.TooManyRedirects("Exceeded max redirects")