Some links on finding the redirection target of a URL from within a web-browser
Posted by jpluimers on 2026/08/26
Likely what I want is not possible because of CORS or CSP (both security features, often mixed up in writings), but just in case below are some links I found.
The problem at hand was that I wanted to use the functionality of a site like [Wayback/Archive] Redirect Checker | Check your Statuscode 301 vs 302, but on the client side because sometimes redirects depend on locality (for example, but not limited to, AliExpress sites).
Thinks like these fail with CSP errors like Refused to connect to 'https://t.co/Ui4Wmesq1j' because it violates the following Content Security Policy directive: "connect-src chrome://resources chrome://theme 'self'".:
var xhr = new XMLHttpRequest();
xhr.onload = function() {
if (this.status < 400 && this.status >= 300) {
console.log('request redirects to ' + this.getResponseHeader("Location"));
} else {
console.log('request does not redirect');
}
}
xhr.open('HEAD', 'https://t.co/Ui4Wmesq1j', true);
xhr.send();
Links – many of them mentioning CORS, but few CSP:
- [WaybackSave/Archive] code.js (the above RAW code from [Wayback/Archive] Unsuccessful Browser client side HTTP redirect checker · GitHub)
- [Wayback/Archive] How to Resolve a Redirected URL Using JavaScript | by Dharmik Donda | Medium
- [Wayback/Archive] detecting a redirect with javascript – how? – Stack Overflow inspired me to the code fragment above that failed.
- [Wayback/Archive] Content Security Policy errors with (Latest) Chrome browser cause Cannot Get error · Issue #2062 · BrowserSync/browser-sync
- [Wayback/Archive] javascript – Chrome Extension “Refused to load the script because it violates the following Content Security Policy directive” – Stack Overflow
A
For those who tumble upon the same issue. I had the same and it was resolved after I updatedcontent_security_policyto include the googleapis url I was trying to load.My code:<head> ... https://maps.googleapis.com/maps/api/js?key=API_KEY;libraries=places </head>Needed{ "content_security_policy": "script-src 'self' 'unsafe-eval' https://maps.googleapis.com 'unsafe-inline'; object-src 'self'", } - [Wayback/Archive] Cannot get next URL for redirect=”manual” · Issue #763 · whatwg/fetch does not mention cors, but mentions the below URL that does:
- [Wayback/Archive] Fetch Standard: Atomic HTTP redirect handling
Redirects (a response whose status or internal response’s (if any) status is a redirect status) are not exposed to APIs. Exposing redirects might leak information not otherwise available through a cross-site scripting attack.
A fetch to
https://wiert.wordpress.com/auththat includes aCookiemarkedHttpOnlycould result in a redirect tohttps://other-origin.invalid/4af955781ea1c84a3b11. This new URL contains a secret. If we expose redirects that secret would be available through a cross-site scripting attack.…
- [Wayback/Archive] Fetch Standard: Atomic HTTP redirect handling
- [Wayback/Archive] javascript – redirect after a fetch post call – Stack Overflow mentions CORS once (but not CSP), but does not explain the implications
- [Wayback/Archive] Get redirect URL JavaScript uses
fetchin a similar way I did (which resulted in CORS or CSP issues) - [Wayback/Archive] ❤ 💻 JavaScript – detect URL request redirection – Dirask
- [Wayback/Archive] How do I handle redirects while scraping with JavaScript? | WebScraping.AI explains a few concepts (apart from using various JavaScript libraries to process the redirects):
- Handling infinite redirects
- Preserving request context
- Logging redirect chains
and gotchas:
- CORS restrictions in browsers may hide redirect locations
- Relative URLs in redirect headers need proper resolution
- Authentication tokens may not persist across redirects
- HTTPS to HTTP redirects may be blocked by browsers
- [Wayback/Archive] How to retrieve the penultimate redirected URL · Issue #1656 · node-fetch/node-fetch
- [Wayback/Archive] Getting the Location Header from the HTTP Redirect Response | by Pavel Polívka | JavaScript in Plain English
…
The browser’s same-origin policy restrictions are still in place for reading headers. So… still stuck.
(Why does it have to be so hard?)The Final Solution: A Proxy Function on Vercel
When it comes to retrieving something that a browser won’t let you read directly, a classic approach is to do it server-side and then return the results to your client. Essentially, you create a proxy. This is often the path of least resistance when dealing with CORS nightmares.…
On CSP, CORS and other documentation:
- CSP: Content Security Policy – Wikipedia
- CORS: Cross-origin resource sharing – Wikipedia
- XMLHttpRequest – Wikipedia
- MDN documentation
- [Wayback/Archive] security – What is the difference between CORS and CSPs? – Stack Overflow (My summary: CORS is server side; CSP is client side – please correct me if I phrased this wrong)
- [Wayback/Archive] Content from “CSP vs CORS: Quick Guide on Essential Web Security Headers” by “Daniel Carlier” as the original cannot be archived: CSP vs CORS: Quick Guide on Essential Web Security Headers | by Daniel Carlier | System Weakness (also converted one of the text source code images to actual source code text).
Queries:
- [Wayback/Archive] javascript redirect checker at DuckDuckGo
- [Wayback/Archive] Refused to connect to ‘https://t.co/Ui4Wmesq1j’ because it violates the following Content Security Policy directive: “connect-src chrome://resources chrome://theme ‘self'”. at DuckDuckGo
- [Wayback/Archive] CORS CSP at DuckDuckGo
- [Wayback/Archive] resolve a URL redirect on the client using javascript at DuckDuckGo
- [Wayback/Archive] javascript fetch redirected url at DuckDuckGo
--jeroen
[Wayback/Archive] Imprint | Redirect Checker
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| var xhr = new XMLHttpRequest(); | |
| xhr.onload = function() { | |
| if (this.status < 400 && this.status >= 300) { | |
| console.log('request redirects to ' + this.getResponseHeader("Location")); | |
| } else { | |
| console.log('request does not redirect'); | |
| } | |
| } | |
| xhr.open('HEAD', 'https://t.co/Ui4Wmesq1j', true); | |
| xhr.send(); |
The Wiert Corner - irregular stream of stuff 
Leave a comment