This question already has an answer here:
Why is this not a good practise? (and the preferred way is to do a 301 from the server side)
- ok SEO while a 301 is preferred for the search bots.
- disable the script in the browser, you are stuck
For onething, according to me, a session fixation through MITM is not possible at least because all the raw response gives me is as below. There is no cookie, whatsoever.
Am I missing something? Are there any attack vectors that I could be up against in the future? Why is this not the recommended way?
do the redirection make a new request. Too bad. I get it. May be your answers/thoughts about how susceptible this could be, would me help sell why this is such a bad idea in terms of security.
Custom client side script instructing the browser to navigate to a different page, and the browser responding to a 301 as in http://paypal.com has fundamental differences I believe. Are they any knows exploits demonstrated in this case?