[whatwg] Workers and URL origin check

On Wed, May 27, 2009 at 5:13 PM, Dmitry Titov <dimich at chromium.org> wrote:
> Should the spec simply require the redirected, final URLs to be checked
> against parent's and reject the script if redirection results in a different
> origin?

I suspect the correct behavior is to make sure every URL on the
redirect chain is from the same origin as the original document.
Letting the attacker redirect to the request to an arbitrary URL in
the victim's origin in a recipe for disaster.

Adam

Received on Thursday, 28 May 2009 00:13:21 UTC