[whatwg] Workers and URL origin check

Adam Barth whatwg at adambarth.com
Thu May 28 00:13:21 PDT 2009


On Wed, May 27, 2009 at 5:13 PM, Dmitry Titov <dimich at chromium.org> wrote:
> Should the spec simply require the redirected, final URLs to be checked
> against parent's and reject the script if redirection results in a different
> origin?

I suspect the correct behavior is to make sure every URL on the
redirect chain is from the same origin as the original document.
Letting the attacker redirect to the request to an arbitrary URL in
the victim's origin in a recipe for disaster.

Adam



More information about the whatwg mailing list