Is there a way to execute XSS? on 302 redirect and the body on the page?

<TITLE>302 Moved Temporarily</TITLE>
The document has moved <A HREF="https://Example.com/">here</A>

I can breakout with " but i can't use any character after < or whole parameter would be removed. Maybe there is a workaround to "stop" the redirect and show HTML? I'm almost 99.99% sure there is a way to break it somehow.

  • 3
    I don't think that the browser renders the body at all on a proper redirect (i.e. status code 302 and Location header). The body is only their for the unusual case of very old clients which don't know what 302 means - i.e. irrelevant. – Steffen Ullrich Oct 11 '18 at 14:34

In many cases a 302 redirect will not contain a body at all.

The RFC only requires a header to indicate the status 302 and the location the user should be redirected to.

As Steffen said, modern browsers ignore the body of the redirect and directly issue a GET for the location specified in the header.

Your Answer

