From 38f470442145193f858287ff5d46b55467492590 Mon Sep 17 00:00:00 2001 From: Smeagol1907 Date: Sat, 22 Aug 2026 22:15:22 +0300 Subject: [PATCH] Prevent unauthorized redirects in fetch options Added 'redirect: error' to fetch options to prevent unauthorized redirects. --- packages/did/src/did-resolvers/web-did-resolver.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/did/src/did-resolvers/web-did-resolver.ts b/packages/did/src/did-resolvers/web-did-resolver.ts index fdbcc25..c636e8f 100644 --- a/packages/did/src/did-resolvers/web-did-resolver.ts +++ b/packages/did/src/did-resolvers/web-did-resolver.ts @@ -74,6 +74,7 @@ async function fetchDidDocumentAtUrl( ): Promise { const res = await fetch(url, { mode: "cors", + redirect: "error", // Following a redirect would send the request to a host the check never saw, which is how a status list URL becomes a probe for internal addresses (same threat model as is-revoked.ts). ...(timeout !== undefined ? { signal: AbortSignal.timeout(timeout) } : {}), })