diff --git a/components/esp_http_client/esp_http_client.c b/components/esp_http_client/esp_http_client.c
index 9299a27167a..97dee14eea6 100644
--- a/components/esp_http_client/esp_http_client.c
+++ b/components/esp_http_client/esp_http_client.c
@@ -1268,6 +1268,14 @@ esp_err_t esp_http_client_set_url(esp_http_client_handle_t client, const char *u
             free(old_host);
             return ESP_ERR_NO_MEM;
         }
+        http_header_delete(client->request->headers, "Authorization");
+        free(client->connection_info.username);
+        client->connection_info.username = NULL;
+        free(client->connection_info.password);
+        client->connection_info.password = NULL;
+        free(client->auth_header);
+        client->auth_header = NULL;
+        _clear_auth_data(client);
         /* Free cached data if any, as we are closing this connection */
         esp_http_client_cached_buf_cleanup(client->response->buffer);
         esp_http_client_close(client);
diff --git a/components/esp_http_client/test_apps/main/test_http_client.c b/components/esp_http_client/test_apps/main/test_http_client.c
index 29214c4059a..26e0cef52b1 100644
--- a/components/esp_http_client/test_apps/main/test_http_client.c
+++ b/components/esp_http_client/test_apps/main/test_http_client.c
@@ -188,6 +188,80 @@ TEST_CASE("esp_http_client_set_header() should not return error if header value
     esp_http_client_cleanup(client);
 }
 
+TEST_CASE("set_url() to a different host strips Authorization header", "[esp_http_client]")
+{
+    esp_http_client_config_t config = {
+        .url = "http://httpbin.org/get",
+    };
+    esp_http_client_handle_t client = esp_http_client_init(&config);
+    TEST_ASSERT_NOT_NULL(client);
+
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_header(client, "Authorization", "Bearer secret-token"));
+
+    char *value = NULL;
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_header(client, "Authorization", &value));
+    TEST_ASSERT_NOT_NULL(value);
+
+    /* Simulate a redirect target */
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_url(client, "http://attacker.example/steal"));
+
+    value = NULL;
+    esp_err_t err = esp_http_client_get_header(client, "Authorization", &value);
+    TEST_ASSERT_EQUAL(ESP_ERR_NOT_FOUND, err);
+    TEST_ASSERT_NULL(value);
+
+    esp_http_client_cleanup(client);
+}
+
+TEST_CASE("set_url() to the same host preserves Authorization header", "[esp_http_client]")
+{
+    esp_http_client_config_t config = {
+        .url = "http://httpbin.org/get",
+    };
+    esp_http_client_handle_t client = esp_http_client_init(&config);
+    TEST_ASSERT_NOT_NULL(client);
+
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_header(client, "Authorization", "Bearer token"));
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_url(client, "http://httpbin.org/other"));
+
+    char *value = NULL;
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_header(client, "Authorization", &value));
+    TEST_ASSERT_NOT_NULL(value);
+    TEST_ASSERT_EQUAL_STRING("Bearer token", value);
+
+    esp_http_client_cleanup(client);
+}
+
+TEST_CASE("set_url() to a different host clears URL-embedded credentials", "[esp_http_client]")
+{
+    esp_http_client_config_t config = {
+        .host = HOST,
+        .path = "/",
+        .username = USERNAME,
+        .password = PASSWORD,
+    };
+    esp_http_client_handle_t client = esp_http_client_init(&config);
+    TEST_ASSERT_NOT_NULL(client);
+
+    char *value = NULL;
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_username(client, &value));
+    TEST_ASSERT_NOT_NULL(value);
+    value = NULL;
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_password(client, &value));
+    TEST_ASSERT_NOT_NULL(value);
+
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_set_url(client, "http://attacker.example/steal"));
+
+    value = NULL;
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_username(client, &value));
+    TEST_ASSERT_NULL(value);
+    value = NULL;
+    TEST_ASSERT_EQUAL(ESP_OK, esp_http_client_get_password(client, &value));
+    TEST_ASSERT_NULL(value);
+
+    esp_http_client_cleanup(client);
+}
+
 static int disconnect_event_count = 0;
 
 static esp_err_t disconnect_event_handler(esp_http_client_event_t *evt)