
Well, Imagine the following scenario:
You order a pizza with all the toppings you like.
Then you get invited to watch a game with your neighbours.
You leave a note on the door saying something like:
"Dear Pizza delivery guy,
We are at the neighbours one floor below - apt. 16, Thanks!"
and of you go to your neighbours to watch that game.
30 min. later more or less, there is a knock on the door,
hmm... I wander who could that be - Yep you guessed right,
Its the Pizza delivery guy!
However - That's wired - Where is the pizza? so naturally you ask him:
"hmm... - Where is my pizza ?"
The delivery guy explains that it is company policy that if there is a note on the door the delivery guy should go to where is indicated in the note but "the delivery guy MUST NOT automatically take the pizza with him unless it can be confirmed by the person who ordered the pizza, since this might change the conditions under which the pizza was ordered."
I don't know about you, but when I leave such a note on the door, I expect the pizza to be redirected with all the toppings.
It might sound wierd when talking about pizzas, IMHO it is not less wierd when talking about HTTP POST Requests that get a response from the 3xx family.
I realy see no security issue with redirecting the pizza, sorry - the post data, to any address the recieving server asked it to be redirected to. After all you have the data was available for that server and he could just take it an send it (back-end) to anywhere he likes. If I trust that site then by transitivity I trust any other site he trusts - not to mention the fact that more often then not it will be just another appartment in the same building, sorry again - another URL in the smae domain.
Now where is my pizza ?!
note: pizza company policy adopted more or less from
http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3one last note - I would agree that a request that was sent using HTTPS should not be allowed to be redirected to a non-HTTPS addres for safty reasons. This is just to make sure the pizza remains hot.