When the Client Follows a Redirect and Re-sends Credentials to the Wrong Host

Quick answer An HTTP client that follows redirects automatically can carry your credentials to a host you never intended to trust. When a 302 or 307 points at a different domain, a client that blindly