Safari seems to drop the Authorization header when following a same-origin 301 redirect. For example, this JS code:
fetch("/api/endpoint-that-redirects", { headers: new Headers({ "Authorization": "sometoken" })})
will trigger one GET to /api/endpoint-that-redirects with the Authorization header, which responds with a 301 w/ Location /api/endpoint. The browser follows this automatically, meaning it makes another GET to /api/endpoint, but this time without the Authorization header.
This seems to be expected behavior when redirecting to a different origin, but I can't see why this would happen if the redirect is to another URL at the same origin.
I've seen a lot of posts online and questions about this behavior on StackOverflow, but I haven't seen any definitive solution or at least an explanation about this behavior. It's also not clear in other questions if the redirect is to the same host.
Chrome (98) and Firefox (97) both follow the redirect and include the Authorization header in the subsequent GET request.