Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this:
<html><body>
You are being <a href="The link where will redirect">redirected</a>.
</body></html>
My questions:
Why there is HTML code, if the browsers will redirect it automatically?
If I inject code in href, can a JavaScript code be executed before the redirection happened or not?
1- why there are html code if the browser will redirect it automatically
It's traditional from the times where 302 was new and not every client understood what it means. It is not really needed today and uselessly wastes bandwidth.
2- if inject code in href, a javascript code can this executed before the redirection happened ? or not ?
If you have a proper 302 response, that is a Location header is present, the body will be ignored and nothing will be executed.
If no Location header is present (which would be an invalid response) it depends on the browser and context: if the URL with the bad 302 was included with img tag or was linked HTML it will often be rendered including the execution of Javascript inside the HTML. In other cases like downloads (link not leading to HTML) or script context it will instead result in an error.
There are firewalls which can be bypassed this way because they don't expect the browser to execute the body of 302 responses and thus skip inspection even if no Location header in the response indicates the target of the redirection.
