diff --git a/Readme.md b/Readme.md
index d544566..ad6cf07 100644
--- a/Readme.md
+++ b/Readme.md
@@ -14,7 +14,8 @@ Please be aware that when moving from 0.8.x to 0.9.0 there are no major API chan
 so that I can release fixes to the 0.8.x stream if problems come out.
 
 Change History
-==============
+============== 
+* 0.9.1 - Added support for automatically following 302 redirects (Thanks neyric)
 * 0.9.0 - Compatibility fixes to bring node-oauth up to speed with node.js 0.4x [thanks to Rasmus Andersson for starting the work ]
 * 0.8.4 - Fixed issue #14 (Parameter ordering ignored encodings).  Added support for repeated parameter names. Implements issue #15 (Use native SHA1 if available, 10x speed improvement!). Fixed issue #16 (Should use POST when requesting access tokens.).  Fixed Issue #17 (OAuth2 spec compliance).  Implemented enhancement #13 (Adds support for PUT & DELETE http verbs). Fixes issue #18 (Complex/Composite url arguments [thanks novemberborn])
 * 0.8.3 - Fixed an issue where the auth header code depended on the Array's toString method (Yohei Sasaki) Updated the getOAuthRequestToken method so we can access google's OAuth secured methods. Also re-implemented and fleshed out the test suite.
diff --git a/lib/oauth.js b/lib/oauth.js
index 3ccdba6..f05d5a8 100644
--- a/lib/oauth.js
+++ b/lib/oauth.js
@@ -310,7 +310,7 @@ exports.OAuth.prototype._performSecureRequest= function( oauth_token, oauth_toke
       response.on('end', function () {
         if( response.statusCode != 200 ) {
           // Follow 302 redirects with Location HTTP header
-          if(response.statusCode == 302 && response.headers.location) {
+          if(response.statusCode == 302 && response.headers && response.headers.location) {
             self._performSecureRequest( oauth_token, oauth_token_secret, method, response.headers.location, extra_params, post_body, post_content_type,  callback);
           }
           else {
diff --git a/package.json b/package.json
index ef09945..0b2e3e5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 { "name" : "oauth"
 , "description" : "Library for interacting with OAuth 1.0, 1.0A and 2.  Provides simplified client access and allows for construction of more complex apis and OAuth providers."
-, "version" : "0.8.4"
+, "version" : "0.9.1"
 , "directories" : { "lib" : "./lib" }
 , "main" : "index.js"
 , "author" : "Ciaran Jessup <ciaranj@gmail.com>"
diff --git a/tests/oauth.js b/tests/oauth.js
index 0585a67..9cb38c9 100644
--- a/tests/oauth.js
+++ b/tests/oauth.js
@@ -1,5 +1,6 @@
 var vows = require('vows'),
     assert = require('assert'),
+    events = require('events'),
     OAuth= require('../lib/oauth').OAuth;
 
 vows.describe('OAuth').addBatch({
@@ -494,6 +495,107 @@ vows.describe('OAuth').addBatch({
              }
            }
          }
+       },
+       'Request With a Callback' : {
+          'And A 302 redirect is received' : {
+            'and there is a location header' : {
+              'it should (re)perform the secure request but with the new location' : function(oa) {
+                var op= oa._createClient;
+                var psr= oa._performSecureRequest;
+                var responseCounter = 1;
+                var callbackCalled = false;
+                var DummyResponse =function() {
+                  if( responseCounter == 1 ){
+                    this.statusCode= 302;
+                    this.headers= {location:"http://redirectto.com"};
+                    responseCounter++;
+                  }
+                  else {
+                    this.statusCode= 200;
+                  }
+                }
+                DummyResponse.prototype= events.EventEmitter.prototype;
+                DummyResponse.prototype.setEncoding= function() {}
+
+                var DummyRequest =function() {
+                  this.response=  new DummyResponse();
+                }
+                DummyRequest.prototype= events.EventEmitter.prototype;
+                DummyRequest.prototype.write= function(post_body){}
+                DummyRequest.prototype.write= function(post_body){
+                  this.emit('response',this.response);
+                }
+                DummyRequest.prototype.end= function(){
+                  this.response.emit('end');
+                }
+
+                try {
+                  oa._createClient= function( port, hostname, method, path, headers, sshEnabled ) {
+                    return new DummyRequest();
+                  }
+                  oa._performSecureRequest= function( oauth_token, oauth_token_secret, method, url, extra_params, post_body, post_content_type,  callback ) {
+                    if( responseCounter == 1 ) {
+                      assert.equal(url, "http://originalurl.com");
+                    }
+                    else {
+                      assert.equal(url, "http://redirectto.com");
+                    }
+                    return psr.call(oa, oauth_token, oauth_token_secret, method, url, extra_params, post_body, post_content_type,  callback )
+                  }
+
+                  oa._performSecureRequest("token", "token_secret", 'POST', 'http://originalurl.com', {"scope": "foobar,1,2"}, null, null, function() {
+                    // callback
+                    assert.equal(responseCounter, 2);
+                    callbackCalled= true;
+                  });
+                  assert.equal(callbackCalled, true)
+                }
+                finally {
+                  oa._createClient= op;
+                  oa._performSecureRequest= psr;
+                }
+              }
+            },
+            'but there is no location header' : {
+              'it should execute the callback, passing the HTTP Response code' : function(oa) {
+                var op= oa._createClient;
+                var callbackCalled = false;
+                var DummyResponse =function() {
+                    this.statusCode= 302;
+                    this.headers= {};
+                }
+                DummyResponse.prototype= events.EventEmitter.prototype;
+                DummyResponse.prototype.setEncoding= function() {}
+
+                var DummyRequest =function() {
+                  this.response=  new DummyResponse();
+                }
+                DummyRequest.prototype= events.EventEmitter.prototype;
+                DummyRequest.prototype.write= function(post_body){}
+                DummyRequest.prototype.write= function(post_body){
+                  this.emit('response',this.response);
+                }
+                DummyRequest.prototype.end= function(){
+                  this.response.emit('end');
+                }
+
+                try {
+                  oa._createClient= function( port, hostname, method, path, headers, sshEnabled ) {
+                    return new DummyRequest();
+                  }
+                  oa._performSecureRequest("token", "token_secret", 'POST', 'http://originalurl.com', {"scope": "foobar,1,2"}, null, null, function(error) {
+                    // callback
+                    assert.equal(error.statusCode, 302);
+                    callbackCalled= true;
+                  });
+                  assert.equal(callbackCalled, true)
+                }
+                finally {
+                  oa._createClient= op;
+                }
+              }
+            }
+          }
        }
      }
 }).export(module);