4 ms·

Really? That seems like a fantastic way to fingerprint people. I would be a bit surprised if that was the case... (Fingerprint usage: have https://myfingerprin

Really? That seems like a fantastic way to fingerprint people. I would be a bit surprised if that was the case... (Fingerprint usage: have https://myfingerprint.example.com https://myfingerprint.example.com 301 to https://myfingerprint.example.com/unique_id_3b136c1cb https://myfingerprint.example.com/unique_id_3b136c1cb, then embed https://myfingerprint.example.com https://myfingerprint.example.com in an iframe and see which request is made.)

kqr 2y ago
I'm not GP but a decade ago when I started out as a web developer I made the mistake of using 301s in production and at the time we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. I still never use 301s for that reason. Things may have changed, but I dare not try!
- geocar 2y ago
  > I still never use 301s for that reason. Things may have changed, but I dare not try! I use 301 for http:->https: redirects because (a) I doubt we're going back, (b) it prevents some cleartext leaks (like the Host header), and (c) it is slightly cheaper. > we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. If you control the target URL it is easy, just redirect back. Seriously: The browser won't loop, it'll just fetch the content again and now not seeing a 301 will forget that nonsense ever happened. This is why 301 is usually a fine default for same-site redirects, or if the redirect target is encoded in the URL (such as in tracking URLs). The big no-no is don't 301 to a URL you can't control unless you have the appropriate Cache-Control headers on the redirect.
  - swiftcoder 2y ago
    > If you control the target URL it is easy, just redirect back. Seriously: The browser won't loop Just uh... don't do this if you have a CDN infront of your site. We had an incident where Cloudfront cached the 301's in both directions
    - geocar 2y ago
      Yeah that's a good point, but one way to think about a CDN is like a web browser that you control, so I say do it even with a CDN and remember you can always just flush the "browser" cache! (or in cloudfront's case: create an invalidation and wait a few seconds)
  - throwawaymobule 2y ago
    Isn't there a https upgrade header specifically for this kind of thing?
    - geocar 2y ago
      Not to my knowledge. How exactly do you think it works?
      - moehm 2y ago
        426 Upgrade Required
SlightlyLeftPad 2y ago
Interesting use case actually. I had never thought of this. I wonder if it’s used in the wild

kqr 2y ago

I'm not GP but a decade ago when I started out as a web developer I made the mistake of using 301s in production and at the time we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. I still never use 301s for that reason. Things may have changed, but I dare not try!

geocar 2y ago
> I still never use 301s for that reason. Things may have changed, but I dare not try! I use 301 for http:->https: redirects because (a) I doubt we're going back, (b) it prevents some cleartext leaks (like the Host header), and (c) it is slightly cheaper. > we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. If you control the target URL it is easy, just redirect back. Seriously: The browser won't loop, it'll just fetch the content again and now not seeing a 301 will forget that nonsense ever happened. This is why 301 is usually a fine default for same-site redirects, or if the redirect target is encoded in the URL (such as in tracking URLs). The big no-no is don't 301 to a URL you can't control unless you have the appropriate Cache-Control headers on the redirect.
- swiftcoder 2y ago
  > If you control the target URL it is easy, just redirect back. Seriously: The browser won't loop Just uh... don't do this if you have a CDN infront of your site. We had an incident where Cloudfront cached the 301's in both directions
  - geocar 2y ago
    Yeah that's a good point, but one way to think about a CDN is like a web browser that you control, so I say do it even with a CDN and remember you can always just flush the "browser" cache! (or in cloudfront's case: create an invalidation and wait a few seconds)
- throwawaymobule 2y ago
  Isn't there a https upgrade header specifically for this kind of thing?
  - geocar 2y ago
    Not to my knowledge. How exactly do you think it works?
    - moehm 2y ago
      426 Upgrade Required

SlightlyLeftPad 2y ago

Interesting use case actually. I had never thought of this. I wonder if it’s used in the wild