AIKIDO-2026-354735

TL;DR

When following redirects, the client decides whether to strip the Authorization header by comparing only the URL netloc and never inspects the scheme. A redirect from an https URL to an http URL on the same host keeps an identical netloc, so the credential is not dropped and is re-sent in cleartext over the plaintext leg. A passive observer on that network path can capture the bearer token or basic credentials. The fix strips sensitive credentials when a redirect downgrades from https to a non-https scheme.