The Location response-header field defines the exact location of the resource that was identified by the Request-URI is used to redirect the recipient to a location other than the Request-URI for completion of the request or identification of a new resource. For 201 (Created) responses, the Location is that of the new resource which was created by the request.

For 3xx responses, the location must SHOULD indicate the server's preferred {1945,2068} URL {2616} URI for automatic redirection to the resource. Only one absolute URL is allowed. The field value consists of a single absolute {1945,2068} URL {2616} URI.

[5] Location 応答頭欄は、要求の完了又は新しい資源の特定のために Request-URI 以外の場所に受信者を再指向 (リダイレクト) するのに使います。 201 (Created: 作成。) 応答では、 Location は要求により作られた新しい資源の場所です。 3xx 要求では、この場所は、資源への自動誘導のための、サーバー側的により好ましい URI を示します。 欄の値は単一の絶対 URI で構成します。

• Location = "Location" ":" absoluteURI {Errata} [ "#" fragment ]

An example is: {2616}

例:

• Location: http://www.w3.org/hypertext/WWW/NewLocation.html
• Location: http://www.w3.org/pub/WWW/People.html

At least one CGI-Field MUST be supplied, but no CGI field name may be used more than once in a response. If a body is supplied, then a "Content-type" header field MUST be supplied by the script, otherwise the script MUST send a "Location" or "Status" header field. If a Location CGI-Field is returned, then the script MUST NOT supply any HTTP-Fields.

[33] 最低1つの CGI 欄を供給しなければなりません。 但し同じ CGI 欄名を1つの応答中に複数使ってはいけません。 本体を供給する場合、 script は「Content-type」 頭欄を供給しなければなりません。 そうでない場合 (本体を供給しない場合) script は は「Location」頭欄か「Status」頭欄を送らなければなりません。 Location CGI 欄を返す場合、 script はどの HTTP 欄も供給してはいけません。

If (and when), the subscription is denied, the hub MUST inform the subscriber by sending an HTTP [RFC2616] GET request to the subscriber's callback URL as given in the subscription request.

Hubs may provide an additional HTTP [RFC2616] Location header (as described in section 14.30 of Hypertext Transfer Protocol [RFC2616]) to indicate that the subscriber may retry subscribing to a different hub.topic. This allows for limited distribution to specific groups or users in the context of social web applications.

Returning HTTP 202 Created and a Location header when creating a post

When the post is created, the Micropub endpoint must return either an HTTP 201 Created status code or HTTP 202 Accepted code, and must return a Location header indicating the URL of the created post. [RFC2616]

After double checking, it could be confirmed that SVN was affected in the worst way: SVN follows HTTP 301 redirects to svn+ssh:// URLs. As a result, an innocent looking HTTP URL can be used to trigger a Command Execution with a 301 redirect.