[loeg]

You know that HTTPS has the Location header too, right? This attack works just as well against HTTPS clients.