Unfortunately there is no way to prevent xhr from auto-following redirects or set credentials for the redirect destination (it would be rather insecure anyway since that would allow the first site to redirect the credentials to any site, not only the one you want to get them).