Re: [whatwg/fetch] should CSP be checked on each redirect? (#485)

@annevk can confirm, but the algorithm is recursive: that is, the last step of https://fetch.spec.whatwg.org/#http-redirect-fetch calls back into Main Fetch. The bits and pieces at the top of that algorithm (including mixed content, hsts, etc) should be executed on every step of a redirect chain. If the request is blocked, it would return a network error.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/485#issuecomment-278776181