In Eclipse Jetty, HttpClient may receive a redirect of the form: If an attacker is able to control the redirects, then HttpClient matches authentication credentials against "/secure" rather than normalizing the path to "/evil", and will therefore follow the redirect sending the "Authorization" header for "/secure" to "/evil". This also mean that the attacker must have an evil application deployed on the same domain as the target.