Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
HTTP redirect everything with
.
and without :
It's actually better than what we had before, let's look at some example hosts: 1. chrissx.de 2. alditalk-kundenbetrug.de 3. 78.47.163.103 4. [2a01:4f8:c0c:69c8::1] 5. zerm.eu:80 6. chrissx.eu.evil.com 7. evil.com 8. localhost 1-4 should be redirected to the same host, 5 with either a changed or removed port, 6-8 should get the client killed. 1 and 2 are the most important ones for normal users, 3-5 might occur, and, again, 6-8 are insane. With the old algorithm, only 1 and 8 were handled correctly, 2 was just missing from the code, 3 and 4 are IPs and just can't be recognized, 5 shows the one major flaw because it redirects to a non-existent HTTPS server at port 80, 6 and 7 get upgraded unnecessarily. With the new algorithm, 1-3 and 8 are handled correctly, 4 and 5 don't get redirected, 6 and 7 get upgraded unnecessarily.
- Loading branch information