Clearly chess.com was using something like "starts with" to process the re-upload. Basically don't re-upload if it starts with https://chess.com https://chess.c

Clearly chess.com was using something like "starts with" to process the re-upload. Basically don't re-upload if it starts with https://chess.com https://chess.com, but filter out if it starts with https://chess.com/registration-invite https://chess.com/registration-invite Typically same origin policies are relaxed for things like images by default [0]. So they came up with a trampoline, they created a chess.com.theirDomain.tld to get past the re-upload filter, which in turn returned a redirect, which the browser followed. [0] https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#cross-origin_network_access https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...