Re: [whatwg/fetch] Redirect loop handling not discussed (Issue #1738)

annevk left a comment (whatwg/fetch#1738)

I see, I think I got confused by this comment from @simon-friedberger: https://github.com/whatwg/fetch/pull/1655#issuecomment-1943496127. That suggested "redirect-like" behavior would also count.

Did someone analyze whether an attacker could use HTTP-redirect loop detection as some kind of side channel?

I understand why we'd want to bail out early for an end-user-facing feature so modulo the attacker concern it makes sense to me to define the HTTP-redirect loop detection and use it for HTTPS upgrades. It seems we could build this on top of request's URL list concept?

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1738#issuecomment-2835037770
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1738/2835037770@github.com>