737465 - Include redirection count in request headers to help redirect loop detection

Status: RESOLVED WONTFIX

(Core :: Networking: HTTP, enhancement)

Description

[Tisza Gergő]

Server bugs resulting in infinite redirect loops can be hard for the maintainer of the server to detect: since the redirect happens as soon as the response headers are received, Javascript etc. is not available, and the server can only use cookies (and sessions) to keep track of redirects. Cookies are shared between browser tabs and windows, so if the user has many tabs and/or the tabs issue lots of AJAX requests, a cookie- or session-based redirect counter could behave in unpredictable ways.

A simple solution to this problem is to send the redirect count as a HTTP header:
- if the HTTP request sent by the browser is a follow-up to a HTTP 30x response, the redirect count is one plus the redirect count of the request belonging to that response;
- otherwise the redirect count is zero;
- if the redirect count is non-zero, include an "X-Redirect-Count: <redirect count>" header in the request.
That way, the server could detect if the redirect count goes e.g. over 10, and log an error. Right now, this kind of error usually goes unnoticed.

Another possible solution would be to implement an auto-notification scheme, something like Content Security Policy violation reports.

Comment 1

[Patrick McManus [:mcmanus]]

would want to see a standard here..