article
Browser checker vetted the address it was asked for, then ignored where it landed
The hidden browser window in my coding app checked the address I asked for against its allowlist and never the one a redirect dropped it on, so it could click, screenshot and certify a page nobody approved. Now the same check runs on the landing address before anything touches the page, though the outside page still gets fetched first.
Read more