6 ms·

We should fix this with a new HTTP header. Browsers can verify that "expect redirect on next request" ends with the correct destination domain. It would be rela

We should fix this with a new HTTP header. Browsers can verify that "expect redirect on next request" ends with the correct destination domain. It would be relatively simple for browsers to implement. Google can set this on the headers for outgoing redirect link they already use for AdWords and search results. It would simply make sure that after all the 30X redirects, you actually land on the expected domain. I can't believe this doesn't already exist. It would be widely useful even outside of ad-tech, when you need redirects for country specific subdomains for instance. And by the other replies on this thread it would fix an ancient security hole at the same time. Anybody want to make an RFC?

boomlinde 7y ago
Google could just display the actual link target on their ads. I'm vehemently against standardizing an HTTP header just to facilitate their continued lying about where their ad links lead. Of course, a user may think twice about loading a link to redirect service when they see the actual URL, and Google wouldn't want that, but that really is their problem. It's sad that we don't hold one of the largest tech companies in the world directly accountable for linking users to phishing scams from spots they've sold to third parties. Instead we discuss how an HTTP header could make it easier for them to lie. Meanwhile, they get paid for facilitating scams. > It would be widely useful even outside of ad-tech, when you need redirects for country specific subdomains for instance. I don't see how that is the case. If I own the hosts and names involved, I know where my links and redirects between the two lead and don't need the client to ensure that it's correct.