If the HTML document makes the redirection instead of 30X status header the resulting document keeps the origin of the redirecting document. This results in requests being made to the wrong origin.
Example: Bluesky's external linking mechanism. https://go.bsky.app/redirect?u=https%3A%2F%2Fgithub.com%2FOrionBrowser
The above page returns Status 200 with the following body:
<html><head><meta http-equiv="refresh" content="0; URL='https://github.com/OrionBrowser'" /><style>:root { color-scheme: light dark; }</style></head></html>
Relative links and assets on the page are linking to go.bsky.app instead of GitHub. Same goes for fetch requests they are all pointing to go.bsky.app.
Tested it on private browsing mode and using compability mode. As far as I can tell it doesn't happen iOS.
Correct origin.
Version 0.99.133-beta (WebKit 621.1.2.111.4) Build date April 21, 2025 MacBook Pro (macOS Sequoia 15.5 build 24F74)
Sequoia (15)
