The Location response-header field defines the exact location of the resource that was identified by the Request-URI is used to redirect the recipient to a location other than the Request-URI for completion of the request or identification of a new resource. For 201 (Created) responses, the Location is that of the new resource which was created by the request.
For 3xx responses, the location must SHOULD indicate the
server's preferred {1945,2068} URL {2616} URI for automatic redirection to the resource. Only one absolute URL is allowed. The field value consists of a single absolute {1945,2068} URL {2616} URI.
[5]Location 応答頭欄は、要求の完了又は新しい資源の特定のために
Request-URI 以外の場所に受信者を再指向するのに使います。
201 (Created: 作成。) 応答では、 Location
は要求により作られた新しい資源の場所です。
3xx 要求では、この場所は、資源への自動誘導のための、サーバー側的により好ましい
URI を示します。
欄の値は単一の絶対 URI で構成します。
Location = "Location" ":" absoluteURI {Errata} [ "#" fragment ]
Note: The Content-Location header field (section 14.15 14.14) differs
from Location in that the Content-Location identifies the original
location of the entity enclosed in the request. It is therefore
possible for a response to contain header fields for both Location
and Content-Location. Also see section 13.10 for cache requirements
of some methods.
At least one CGI-Field
MUST be supplied, but no CGI field name may be used more than
once in a response. If a body is supplied, then a
"Content-type" header field MUST be supplied by the script,
otherwise the script MUST send a "Location" or "Status" header
field. If a Location CGI-Field is returned, then the script
MUST NOT supply any HTTP-Fields.
The Location value is either an absolute URI with optional
fragment, as defined in RFC 1630 [1], or an absolute path
within the server's URI space (i.e., omitting the scheme and
network-related fields) and optional query-string. If an
absolute URI is returned by the script, then the server MUST
generate a '302 redirect' HTTP response message unless the
script has supplied an explicit Status response header field.
Scripts returning an absolute URI MAY choose to provide a
message-body. Servers MUST make any appropriate modifications
to the script's output to ensure the response to the
user-agent complies with the response protocol version. If the
Location value is a path, then the server MUST generate the
response that it would have produced in response to a request
containing the URL
[20]Location 値は、 RFC1630 で定義されている絶対
URI 及び省略可能な断片か、又はサーバーの URI
空間内の絶対経路 (すなわち、scheme とネットワーク関連欄を省略したもの。)
及び省略可能な query-string のいずれかです。
絶対 URI が script により返された場合、サーバーは、
Status 応答頭欄が明示的に指定されていない限り、
「302 redirect」 HTTP 応答メッセージを生成しなければなりません。
絶対 URI を返す script は message-body
を提供することを選んでも構いません。
サーバーは、利用者エージェントへの応答が応答のプロトコルの版に合致することを確実にするため、
script の出力を適当に修正しなければなりません。
Location 値が経路である場合、サーバーは >>21 の URL
を含む要求への応答であるとして応答を生成しなければなりません。
Note: If the request was accompanied by a message-body (such
as for a POST request), and the script redirects the request
with a Location field, the message-body may not be available
to the resource that is the target of the redirect.
[42] Loading Data with a POST Request - Google BigQuery — Google Cloud Platform ( 版) https://cloud.google.com/bigquery/loading-data-post-request#save-session-uri
If (and when), the subscription is denied, the hub MUST inform the subscriber by sending an HTTP [RFC2616] GET request to the subscriber's callback URL as given in the subscription request.
Hubs may provide an additional HTTP [RFC2616] Location header (as described in section 14.30 of Hypertext Transfer Protocol [RFC2616]) to indicate that the subscriber may retry subscribing to a different hub.topic. This allows for limited distribution to specific groups or users in the context of social web applications.
[48] Kolejny XSS w www.google.com (Custom Search Engine)
( 版)
http://sekurak.pl/kolejny-xss-w-www-google-com-custom-search-engine/
[51] Fix #111: forbid redirects to data URLs · whatwg/fetch@f986c43
( 版)
https://github.com/whatwg/fetch/commit/f986c43f958a0f7ffdc46553d5a53a0c56a89a32
[52] 655389 – CRLF Injection and the parsing of HTTP headers
( 版)
https://bugzilla.mozilla.org/show_bug.cgi?id=655389
[53] Merge URLUtils into Location · whatwg/html@f0a7365
( 版)
https://github.com/whatwg/html/commit/f0a73659b4046cc35a28855f3544dead66345689
[54] Defining exotic objects in IDL, HTML, or both?
(Anne van Kesteren 著, 版)
https://lists.w3.org/Archives/Public/www-archive/2015Oct/0009.html
[60] 1142083 – IDN Unicode domain redirect is broken in Firefox 36/37/38
( 版)
https://bugzilla.mozilla.org/show_bug.cgi?id=1142083
[61]>>60http://zymiausifotografai.lt/
HTTP/1.1 301 Moved Permanently
Date: Fri, 06 Nov 2015 09:15:23 GMT
Server: Apache
Location: http://www.žymiausifotografai.lt
Vary: Accept-Encoding
Content-Length: 312
Connection: close
Content-Type: text/html; charset=iso-8859-1
[62] Add some more parameters to the "perform a security check" hook (for … · heycam/webidl@adf3772
( 版)
https://github.com/heycam/webidl/commit/adf37720bd92138f9f1627a214330287550c0004
[63] 29383 – Need a way to define toJSON, valueOf, @@toPrimitive
( 版)
https://www.w3.org/Bugs/Public/show_bug.cgi?id=29383
[64] 27361 – [Unforgeable] and "[[Enumerable]]: true"
( 版)
https://www.w3.org/Bugs/Public/show_bug.cgi?id=27361
[65] 29183 – Objects that implement an [Unforgeable] interface should have a non-configurable @@toPrimitive method
( 版)
https://www.w3.org/Bugs/Public/show_bug.cgi?id=29183
When the post is created, the Micropub endpoint must return either an HTTP 201 Created status code or HTTP 202 Accepted code, and must return a Location header indicating the URL of the created post. [RFC2616]
[78] Compromise On Checkout - Vulnerabilities in SCM Tools · The Recurity Lablog
( ())
http://blog.recurity-labs.com/2017-08-10/scm-vulns
After double checking, it could be confirmed that SVN was affected in the worst way: SVN follows HTTP 301 redirects to svn+ssh:// URLs. As a result, an innocent looking HTTP URL can be used to trigger a Command Execution with a 301 redirect.
[79] RFC 4437 - Web Distributed Authoring and Versioning (WebDAV) Redirect Reference Resources
()
https://tools.ietf.org/html/rfc4437#section-5