26238 2014-06-30 11:39:18 +0000 [new feature] Add follow redirects back 2015-03-27 12:29:42 +0000 1 1 1 Unclassified WebAppsWG XHR unspecified PC All RESOLVED DUPLICATE 28343 P2 minor --- 1 jonathan annevk hsteen mike public-webapps public-webapps-bugzilla oldest_to_newest 108483 0 jonathan 2014-06-30 11:39:18 +0000 Add follow redirects back into WHATWG XHR specification: http://xhr.spec.whatwg.org/ As mentioned on this post: http://discourse.specifiction.org/t/followredirects-in-xmlhttprequest/420/11?u=jonathank The intent is to put back in the followRedirects feature which was a security improvement from the client side to prevent calls following to unexpected URL changes. The expected result when the AJAX request returns a redirect code and followRedirects is disabled then it should return a network error. This should follow the same definition as the original specification: http://www.w3.org/TR/2010/WD-XMLHttpRequest2-20100907/#the-followredirects-attribute However it shouldn't return a response if there is a redirect just a network error to the callbacks. 108484 1 annevk 2014-06-30 11:42:09 +0000 So the use case here is failing early, right? 108485 2 jonathan 2014-06-30 11:47:19 +0000 That is right, so to prevent scripts that really only want the one resource to be able to turn off the feature of jumping through the redirects. The behaviour should be a browser engineered error code sent to the callbacks. The browser should not follow any redirects at all, only one server call should be made. 108488 3 annevk 2014-06-30 13:21:01 +0000 If we add this we should probably name it disableRedirectHandling per bug 25791. failOnRedirects or some such could maybe also work. 113467 4 annevk 2014-10-20 16:19:42 +0000 I found out that with HSTS this could be used to detect whether a user has previously visited a site. It might be that CSP and other features enable the same kind of attack however. 113468 5 annevk 2014-10-20 16:20:10 +0000 However, if we add this we might add it as a feature for fetch() instead. 118978 6 annevk 2015-03-27 12:29:42 +0000 fetch() it is. *** This bug has been marked as a duplicate of bug 28343 ***