Authorization header retained across host change

On a cross-host redirect the Authorization and Cookie headers are replayed to the new host. A third-party endpoint that redirects can harvest the caller`s credentials.

SyntheticThis advisory is invented for the demonstration. follow-redirects is a real package; nothing described here has been reported against it.