Re: [whatwg/fetch] Why does Fetch specify a max redirect count of 20? (#576)

> @lbherrera found [a new attack vector using this limit](https://docs.google.com/presentation/d/1rlnxXUYHY9CHgCMckZsCGH4VopLo4DYMvAcOltma0og/edit). In particular, because there is this limit one can figure out how many redirect hops an endpoint goes through.

I thought we’d already generalized this to being that any resource limit (memory, response size, bandwidth, connections, ports, etc), whether per-origin or system wide, can be used as an XSLeak, but it is always interesting to see examples of it.

I’m not sure we should tackle it in this issue, since short of removing all limits, we’ll still need some value for a limit, even if that expression needs to change (which is unclear to me if it does / what the risk of the URL list size is). Perhaps we should tackle it separately?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/576#issuecomment-769859529