fetch() that checks every redirect target against the guard.
A plain redirect: 'follow' checks only the URL it was handed, so an allowed host could answer
302 to a refused one. Hops follow the fetch spec: 301 and 302 turn a POST into a GET, 303 turns
anything but GET and HEAD into a GET, and credentials do not cross an origin.
fetch()that checks every redirect target against the guard.A plain
redirect: 'follow'checks only the URL it was handed, so an allowed host could answer 302 to a refused one. Hops follow the fetch spec: 301 and 302 turn a POST into a GET, 303 turns anything but GET and HEAD into a GET, and credentials do not cross an origin.