FlowDrop Workflow Specification 1.0-draft

The redirect posture is stated, not inherited

These restate what most HTTP clients already default to, deliberately: the posture is a decision, not whatever the client happens to ship.

The rule

Normative: this is the rule
  1. Outbound requests follow at most 5 redirects.
  2. A redirect of a POST degrades to GET rather than preserving the method.
  3. The originating URL and its query string are never sent to the next host as a referrer.
  4. Hops are restricted to http and https, so the scheme check cannot be sidestepped mid-chain.
  5. Where a node is configured to permit internal requests, the per-hop check is dropped exactly as the initial check is (a node allowed to talk to the internal network may also be redirected within it), but the hop limit binds either way.
Rule identifiers are permanent and are never renumbered. Each implementation publishes its own standing against these rules; this specification does not.spec 1.0-draft · NET-3 · changed in spec 1.0