lundi 3 août 2015

Safari failing to follow server-side redirect with https and hash params

Safari (8.0.7 in my case) is failing to follow a redirect. This is working in Chrome and only fails in a very specific scenario.

As best I can tell, the redirect will only fail when moving between two https connections on different domains/subdomains when hash params are involved. It will work with query params or if one of the domains is localhost.

According to http://ift.tt/1P1ClYh, it seems that Safari would not honor hash params in redirects at one point in the past, but I cannot confirm if this is still the case.

It's looking to be a security/sandbox issue, but I'd be interested if anyone can put an exact finger on this issue.




Aucun commentaire:

Enregistrer un commentaire