When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max redirects, and removes only the Host header. It does not clear Authorization, auth username, auth password, or auth mode when the redirect target changes origin.

As a result, credentials intended for one origin can be forwarded to a different origin when follow redirects=True, which is the default.

Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.