Why a 401/403 after a cross-origin redirect is not about the credentials: they were
never sent to the server that answered. An http→https redirect on the same host gets
its own advice (use the https base URL), since that is the usual way to get here.
Why a 401/403 after a cross-origin redirect is not about the credentials: they were never sent to the server that answered. An http→https redirect on the same host gets its own advice (use the https base URL), since that is the usual way to get here.