Hacker News new | ask | show | jobs
by DistractionRect 881 days ago
Clearly chess.com was using something like "starts with" to process the re-upload. Basically don't re-upload if it starts with https://chess.com, but filter out if it starts with https://chess.com/registration-invite

Typically same origin policies are relaxed for things like images by default [0]. So they came up with a trampoline, they created a chess.com.theirDomain.tld to get past the re-upload filter, which in turn returned a redirect, which the browser followed.

[0] https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...