This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
"2.6 Fetching resources": "Note: The HTTP specification requires that 301, 302, and 307 redirects, when applied to methods other than GET or HEAD, not be followed without user confirmation." This is misleading; this is a known and confirmed bug in RFC 2616. The restriction is not on GET/HEAD, but on safe methods.
Maciej Stachowiak points out that we did not fix this everywhere (http://lists.w3.org/Archives/Public/ietf-http-wg/2010JanMar/0170.html), the introduction to 3xx still says: "The action required MAY be carried out by the user agent without interaction with the user if and only if the method used in the second request is GET or HEAD."
(In reply to comment #1) > Maciej Stachowiak points out that we did not fix this everywhere > (http://lists.w3.org/Archives/Public/ietf-http-wg/2010JanMar/0170.html), the > introduction to 3xx still says: > > "The action required MAY be carried out by the user agent without interaction > with the user if and only if the method used in the second request is GET or > HEAD." See also http://trac.tools.ietf.org/wg/httpbis/trac/ticket/10#comment:5
EDITOR'S RESPONSE: This is an Editor's Response to your comment. If you are satisfied with this response, please change the state of this bug to CLOSED. If you have additional information and would like the editor to reconsider, please reopen this bug. If you would like to escalate the issue to the full HTML Working Group, please add the TrackerRequest keyword to this bug, and suggest title and text for the tracker issue; or you may create a tracker issue yourself, if you are able to do so. For more details, see this document: http://dev.w3.org/html5/decision-policy/decision-policy.html Status: Accepted Change Description: no spec change Rationale: This seems to have been fixed already. It's likely that this will change again (in a way that violates HTTP, if HTTP isn't fixed) to say that no UI is necessary for any redirects but that certain redirects just get blocked (e.g. cross-site DELETE or PUT from a form submission).