436243 - NSS's built-in http clients for fetching certs, CRLs and OCSP must handle http redirects

Status: RESOLVED WONTFIX

(NSS :: Libraries, enhancement, P5)

Description

[Nelson Bolyard (seldom reads bugmail)]

It has come to light that the CAs in the CABForum believe that it is 
legitimate and acceptable for their http servers that respond to URLs
for fetching certs, CRLs and OCSP repsonses to return http redirects.

Apparently some of them have http servers acting as OCSP responders that
presently return redirects to some of the http requests for OCSP requests.

NSS's built in http client must be able to handle it.

Comment 1

[Julien Pierre]

I am not sure how legit it is for a server to respond with a redirect in answer to a POST request. I don't think the behavior for the client in this case is standards-defined.

If the request was a GET, then it is legit.