{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/66","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/66/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/66/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/66/events","html_url":"https://github.com/whatwg/fetch/issues/66","id":88991420,"number":66,"title":"Allow \"manual\" redirect fetches with caveats","user":{"login":"jakearchibald","id":93594,"avatar_url":"https://avatars.githubusercontent.com/u/93594?v=3","gravatar_id":"","url":"https://api.github.com/users/jakearchibald","html_url":"https://github.com/jakearchibald","followers_url":"https://api.github.com/users/jakearchibald/followers","following_url":"https://api.github.com/users/jakearchibald/following{/other_user}","gists_url":"https://api.github.com/users/jakearchibald/gists{/gist_id}","starred_url":"https://api.github.com/users/jakearchibald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jakearchibald/subscriptions","organizations_url":"https://api.github.com/users/jakearchibald/orgs","repos_url":"https://api.github.com/users/jakearchibald/repos","events_url":"https://api.github.com/users/jakearchibald/events{/privacy}","received_events_url":"https://api.github.com/users/jakearchibald/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-06-17T11:37:52Z","updated_at":"2015-06-17T12:15:40Z","closed_at":null,"body":"https://fetch.spec.whatwg.org/#dom-request step 19:\r\n\r\n> If request's redirect mode is \"manual\", set it to \"follow\".\r\n\r\nThis is causing problems for service worker users doing `event.respondWith(fetch(event.request))` in the following situations:\r\n\r\n1. Same-origin navigation resulting in same-origin redirect\r\n2. Same-origin navigation resulting in same-origin redirect but destination url is under the scope of a different SW\r\n3. Same-origin navigation resulting in cross-origin redirect\r\n\r\nWhile https://github.com/slightlyoff/ServiceWorker/issues/607 will deal with 1, it won't solve the others.\r\n\r\n* The destination response is served against the original request url, breaking relative urls\r\n* For 2, the result is controlled by the wrong service worker\r\n* For 3, the result is a network error as per https://fetch.spec.whatwg.org/#http-fetch 2.2\r\n* For 2, it can be worked-around by checking a mismatch between `request.url` and `response.url` & returning `Response.redirect(response.url)`, but this results in a double-request\r\n* 3 cannot be worked around\r\n\r\nCould we allow manual redirects with fetch, but where the response has some degree of opaqueness for security? This would involve hiding the `location` response header at least."},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/112778441","html_url":"https://github.com/whatwg/fetch/issues/66#issuecomment-112778441","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/66","id":112778441,"user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"created_at":"2015-06-17T12:15:40Z","updated_at":"2015-06-17T12:15:40Z","body":"Did you have it analyzed? There's a reason redirects are indistinguishable from network errors today."}}