On Wed, May 27, 2009 at 5:13 PM, Dmitry Titov <dim...@chromium.org> wrote: > Should the spec simply require the redirected, final URLs to be checked > against parent's and reject the script if redirection results in a different > origin?
I suspect the correct behavior is to make sure every URL on the redirect chain is from the same origin as the original document. Letting the attacker redirect to the request to an arbitrary URL in the victim's origin in a recipe for disaster. Adam
