Re: [fetch] Add a bit to Opaque Responses to distinguish redirects (#79)

The PoC in http://sirdarckcat.blogspot.de/2015/05/service-workers-secure-open-redirect.html should work (it's non-HTTPS but the iframe is SSL).

I can imagine a couple other possible attacks, but they depend on how the Cache.match algorithm behaves, which IMHO is where we should fix this.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/79#issuecomment-125580485