Titanium SDK 7.0/8.0: HTTPClient redirect header preservation diverges between NSURLSession and OkHttp backends

Cross-platform redirect behavior

Since Titanium SDK 7.0 migrated iOS to NSURLSession and SDK 8.0 migrated Android to OkHttp, both backends enable HTTP keep-alive by default and follow redirects automatically. However, the handling of request headers — particularly Authorization — on cross-origin redirects differs between the underlying platform stacks. NSURLSession may drop Authorization headers when redirecting across origins, while OkHttp preserves headers per RFC 7231 up to its 20-redirect limit. Titanium does not expose a unified redirect policy API to control or inspect this behavior.

Unresolved compatibility boundary

Applications that rely on consistent auth-header forwarding through redirect chains (e.g., OAuth flows, API gateways with intermediate 302s) cannot guarantee identical behavior on iOS and Android using the standard HTTPClient. The SDK changelogs for 7.0.0 and 8.0.0 document the backend switches but do not specify a cross-platform redirect contract. Workarounds such as disabling keep-alive or manually handling redirects via onreadystatechange defeat connection reuse benefits and increase latency.

What is the documented or observable behavior for Authorization header preservation on cross-origin redirects for each platform backend in Titanium SDK 12.x? Does setting validatesSecureCertificate=false or custom header manipulation via setRequestHeader alter the platform default? Is there a supported pattern to achieve parity without abandoning HTTPClient keep-alive?