w3c/webappsec — pull request #18 by mikewest (2014-05-16 07:11:22+00:00)
Title: CSP: Document proposed solution to redirect-target path leakage.

In a nutshell, this proposal patches the matching algorithm to ignore
the path component in source expressions if the URL being matched is the
result of an HTTP redirect. Since these requests will now be host/scheme
based, we still get reasonable protection by limiting resources to
allowed origins after a redirect, while not allowing malicious parties
to brute-force paths through cleverness.