[whatwg] Workers and URL origin check
Adam Barth
whatwg at adambarth.com
Thu May 28 00:13:21 PDT 2009
On Wed, May 27, 2009 at 5:13 PM, Dmitry Titov <dimich at chromium.org> wrote:
> Should the spec simply require the redirected, final URLs to be checked
> against parent's and reject the script if redirection results in a different
> origin?
I suspect the correct behavior is to make sure every URL on the
redirect chain is from the same origin as the original document.
Letting the attacker redirect to the request to an arbitrary URL in
the victim's origin in a recipe for disaster.
Adam
More information about the whatwg
mailing list