Re: [whatwg/fetch] Why does Fetch specify a max redirect count of 20? (#576)

@lbherrera found [a new attack vector using this limit](https://docs.google.com/presentation/d/1rlnxXUYHY9CHgCMckZsCGH4VopLo4DYMvAcOltma0og/edit). In particular, because there is this limit one can figure out how many redirect hops an endpoint goes through.

Before redirecting to the victim endpoint you would first redirect limit - 1, then limit - 2, etc. on an attacker endpoint and observe differences in the handling of the response (network error vs not).

This means that response's URL list's size is exposed.

Questions:

1. Should we attempt to tackle this?
2. Do people have proposals for how to tackle this?



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/576#issuecomment-769849858