Re: [whatwg/fetch] Cannot get next URL for redirect="manual" (#763)

If we talk about security considerations, why not let CORS policy deal with this?

The example pointed on https://fetch.spec.whatwg.org/#atomic-http-redirect-handling is useless. With the same regard I could say `redirect: "follow"` and then extract any secret information from this response:


```javascript
fetch("/account/", {
    credentials: 'same-origin',
    redirect: 'follow',
}).then((response) => {
    console.log("Here is my secret URL", response.url);
})
```

That would not work for multi-step redirects (original page -> secret URL -> target public page).

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/763#issuecomment-1431380311
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/763/1431380311@github.com>