121–130 of 135 posts
I have done this once in the past, for a sort of community project. the project was at example.org and I had a VPS with a free domain I didn't use, so I had the example.[something] pointed there for a couple years. Basically just white-hat domain squatting it so no one else snags it up.
If they want to sell you sth, or scam, they won't do 301, because after 301 the juice power will gradually move to your domain, and its pointless to do this before any scams and sales.
Earlier quoted context omitted.
> I still never use 301s for that reason. Things may have changed, but I dare not try! I use 301 for http:->https: redirects because (a) I doubt we're going back, (b) it prevents some cleartext leaks (like the Host header), and (c) it is slightly cheaper. > we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. If you control the target URL it is easy, just red…
> If you control the target URL it is easy, just redirect back. Seriously: The browser won't loop Just uh... don't do this if you have a CDN infront of your site. We had an incident where Cloudfront cached the 301's in both directions
Earlier quoted context omitted.
> I still never use 301s for that reason. Things may have changed, but I dare not try! I use 301 for http:->https: redirects because (a) I doubt we're going back, (b) it prevents some cleartext leaks (like the Host header), and (c) it is slightly cheaper. > we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. If you control the target URL it is easy, just red…
Isn't there a https upgrade header specifically for this kind of thing?
Earlier quoted context omitted.
Sounds like a security flaw that browsers honor this.
Referer is not a security mechanism.
Earlier quoted context omitted.
Referer is not a security mechanism.
I didn't say it was. Browsers display an alert when full-screen mode is activated. Full-screen mode isn't a security feature, but the browser does something the website developer can't control so that users can conclude that something fishy isn't going on. I think the ability for one website to hide that they've redirected to another is a vulnerability.
Earlier quoted context omitted.
Just a note 301s are super sticky and browsers cache them even across incognito modes. Your best bet is to use a new browser after reconnecting to avoid false results.
On Chromium-based browsers, if you open the Developer Tools (F12 or Inspect in right click) and you go to the Network tab, you can click 'Disable Cache'. In my experience, this solves the sticky 301 issue and you should have no issues with cached 301s anymore. Works perfect for these kind of investigations or if you made a mistake during site development.
Phishing. Regular visits to these domains will 301 redirect them to you, but there's at least one URL that will instead be handled by the scammers themselves. They'll then send out an email campaign with a From: address in the counterfeit domain (which will have valid SPF/DKIM/whatever), a subject like "Example.com: You've been invited to join a project!", quickly-come-see-this-secret-stuff body copy, and a call-to-a…
You cannot detect the redirect, so you cannot display any such warning.
Earlier quoted context omitted.
You cannot detect the redirect, so you cannot display any such warning.
Can't you check the Referer?