Cached redirects + History traversal reveal cross-origin URLs

[igrigorik]

History records the redirected-to URL and triggering history.back() on an iframe creates a ResourceTiming object with name attribute set to said URL.

• PoC: http://vwzq.net/lab/xreadurl/ - FF, IE, Chrome all have the same issue.
• Chrome bug: https://code.google.com/p/chromium/issues/detail?id=511616
• History traversal: https://html.spec.whatwg.org/multipage/browsers.html#traverse-the-history-by-a-delta

name: This attribute must return the resolved URL of the requested resource. This attribute must not change even if the fetch redirected to a different URL -- current definition.

Similarly, our processing section records the resolved URL of the requested resource. As such, I don't believe this is a RT spec bug, but the fact that all implementations are subject to this does indicate that we may want to add some language to make this explicit.

/cc @annevk @toddreifsteck @plehegar

[dveditz]

Firefox bug is https://bugzilla.mozilla.org/show_bug.cgi?id=1185256

[cgvwzq]

Specific PoCs:

• Chrome: http://vwzq.net/lab/xreadurl/chrome.html
• FF: http://vwzq.net/lab/xreadurl/ff.html

[igrigorik]

This has been resolved in Chrome (crbug.com/511616). Not sure about status in other browsers.

[igrigorik]

Resolving this as I don't believe there is anything actionable within the spec itself.