[whatwg/fetch] Model HSTS and Upgrade-Insecure-Request as a redirect. (#324) from Mike West on 2016-06-13 (public-webapps-github@w3.org from June 2016)

From: Mike West <notifications@github.com>
Date: Mon, 13 Jun 2016 01:04:27 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc:
Message-ID: <whatwg/fetch/issues/324@github.com>

Chrome models HSTS as a 307 redirect internally, which has implications for things like referrer policy, CORS, etc. Based on https://dxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsHttpChannel.cpp#2141, it looks like Firefox works like this as well (though someone who's more familar with the code should help me out... :) ).

It seems reasonable for us to model UIR similarly, with similar implications.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/324

Received on Monday, 13 June 2016 08:04:57 UTC