3 ms·

I haven't actually dug into it, but I would assume that open redirects would strip a Sec-Fetch-Site: cross-site header and replace it with none or same-site or

by Eridrus 10mo ago

I haven't actually dug into it, but I would assume that open redirects would strip a Sec-Fetch-Site: cross-site header and replace it with none or same-site or something. So would things like allowing users to specify image URLs, etc. And if you rely on Sec-Fetch-Site for security on GETs, these turn into actual vulnerabilities. I think these sorts of minor web app issues are common enough that state changing GETs should be explicitly discouraged if you are relying on Sec-Fetch-Site.

nchmy 10mo ago
https://www.w3.org/TR/fetch-metadata/#redirects https://www.w3.org/TR/fetch-metadata/#redirects
- Eridrus 10mo ago
  Well that's a good decision. I doubt it covers client-side redirects, but still good for like 95% of cases. People do still allow 3rd party images/links on websites. Much less common in typical software, but it does happen.
  - nchmy 10mo ago
    why wouldnt it cover client-side redirects?
    - Eridrus 10mo ago
      Why would it? Someone has to go and write the code to do it and the spec doesn't look like it covers them. Playing with window.location and meta redirects in jsfiddle, they both seem to lose cross-site context when I link to them.
      - nchmy 10mo ago
        Can you share an example?