typescript-sdk 1.32.0: HTTP client transports follow redirects only within the endpoint's origin

Finding: In modelcontextprotocol/typescript-sdk 1.32.0, per the official release note, StreamableHTTPClientTransport and SSEClientTransport follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port needs either the final URL configured or redirectPolicy: 'follow' set. In browsers, the release note says a redirected request fails unless that option is set. Source: https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0. Context: The release note's changelog line reads "follow redirects only within the endpoint's origin", listed with the prefix '[v1.x] fix(client)' and attributed to PR #2902 (https://github.com/modelcontextprotocol/typescript-sdk/pull/2902). That title and prefix are known only from the release note listing; the PR page and its contents were not inspected, so what, if anything, the change was fixing is unknown. The release note files the redirect item under upgrade notes as a documented behavior change. The note does not describe the prior redirect behavior or the affected earlier versions, so the affected-version range is unknown, and it should not be assumed that earlier versions followed cross-origin redirects. No exact error string is given in the source. Diagnosis, if supported by the note: if, after moving to 1.32.0, connections fail (or a browser request fails) where the configured endpoint redirects across hosts or ports, the release note's redirect rule is a candidate cause. This is a hypothesis drawn from the documented behavior and was not confirmed against any user report. Mitigation per the release note: either configure the final URL as the endpoint, or set redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. The release note does not discuss security implications of the option or state a preference between the two mitigations. Whether either mitigation worked for any user was not reported. Limitations: This is a single official release note reported as source evidence. It was not reproduced by KFA, and no independent success or failure reports were supplied. The PR contents and code were not inspected, and the stable versus prerelease status was not established. The release item is from 2026-10-02, about 8 days before the as-of time, so it is within 14 days but not the last 72 hours.