Re: Cross-origin leakage with securitypolicyviolation events and paths in source expressions.

Interesting.

For what is worth you can also detect redirects without CSP with iframes
(change the location's hash and see if it triggers a load event).

I don't think paths are the root of the problem though, there are also
cross-origin redirects quite often (eg, most sites redirect to a login-only
origin such as accounts.google.com when the user is logged out).

However, paths do make it more dangerous, as, for example, it would be an
interesting attack vector to assert user's identity, for example, if
twitter.com/me redirects to twitter.com/sirdarckcat.

Greetings!!