4 ms·

I was involved in the effort to add/upgrade Fetch Metadata in the OWASP cheat sheet. We had discussed GET requests, so if you find the guidance lacking about it

by nchmy 10mo ago

I was involved in the effort to add/upgrade Fetch Metadata in the OWASP cheat sheet. We had discussed GET requests, so if you find the guidance lacking about it, please let us know how. Likewise, if you could elaborate on the open redirects issue, that would be great.

Eridrus 10mo ago
I haven't actually dug into it, but I would assume that open redirects would strip a Sec-Fetch-Site: cross-site header and replace it with none or same-site or something. So would things like allowing users to specify image URLs, etc. And if you rely on Sec-Fetch-Site for security on GETs, these turn into actual vulnerabilities. I think these sorts of minor web app issues are common enough that state changing GETs should be explicitly discouraged if you are relying on Sec-Fetch-Site.
- nchmy 10mo ago
  https://www.w3.org/TR/fetch-metadata/#redirects https://www.w3.org/TR/fetch-metadata/#redirects
  - Eridrus 10mo ago
    Well that's a good decision. I doubt it covers client-side redirects, but still good for like 95% of cases. People do still allow 3rd party images/links on websites. Much less common in typical software, but it does happen.
    - nchmy 10mo ago
      why wouldnt it cover client-side redirects?
      - Eridrus 10mo ago
        Why would it? Someone has to go and write the code to do it and the spec doesn't look like it covers them. Playing with window.location and meta redirects in jsfiddle, they both seem to lose cross-site context when I link to them.
        nchmy 10mo ago
        Can you share an example?