5 ms·
The first thing I thought of was when you go to a URL but it requires a login so it redirects you to the login page but then redirects you back to your original
by hk1337 6y ago
The first thing I thought of was when you go to a URL but it requires a login so it redirects you to the login page but then redirects you back to your original page after you login. Pretty sure it’s easily remedied without referer but that was the first thing I thought about.
- bdcravens 6y agoIf the login is on the same site, this change won't affect that, as this change only applies to cross-original requests.
- merb 6y agothat is a security issue on it's own. you should never have an openredirect bug, that's why openid servers need to store redirect uris somewhere and validate them.