title: HTTP redirect to URI with leading slash+blackslash "/\example.com" considered absolute on Chrome / IE
body: <p>An HTTP request is sent to website <code>http://www.foobar.com/</code>,
  the servers responds with the following HTTP <code>Location</code> header
  (leading slash and backslah, followed by a hostname)</p>
  <pre><code>Location:/\example.com
  </code></pre>
  <p>Two behaviors can be observed depending on the browser being used :</p>
  <ul>
  <li><p>On <em>Google Chrome 43</em> (windows and linux), <em>Internet Explorer 11</em>, the browser then request the following URI (as if the location header value was a protocol relative URI):</p>
  <p><code>http://example.com</code></p>
  </li>
  <li><p>On <em>Firefox 38</em>, <em>Safari 8</em>, <em>Epiphany</em> or <em>Curl</em>, the following request is performed :</p>
  <p><code>http://www.foobar.com/\example.com</code></p>
  </li>
  </ul>
  <p>As far as I understand the specification, the behavior applied by Chrome and IE is incorrect.</p>
  <p>The <strong><a href="https://www.rfc-editor.org/rfc/rfc7231#section-7.1.2" rel="nofollow noreferrer">HTTP 1.1 specification (RFC 7231)</a></strong> defines <code>Location</code> header in section 7.1.2 [emphasis added] :</p>
  <blockquote>
  <p>The &quot;Location&quot; header field is used in some responses to refer to a
  specific resource in relation to the response.  The type of
  relationship is defined by the combination of request method and
  status code semantics.</p>
  <pre><code>Location = URI-reference
  </code></pre>
  <p>The field value consists of a single URI-reference.  <strong>When it has the
  form of a relative reference ([RFC3986], Section 4.2), the final
  value is computed by resolving it against the effective request URI
  ([RFC3986], Section 5).</strong></p>
  </blockquote>
  <p>The <strong><a href="https://www.rfc-editor.org/rfc/rfc3986#section-4.2" rel="nofollow noreferrer">URI specification (RFC 3986)</a></strong> defines relative reference in section 4.2 [emphasis added] :</p>
  <blockquote>
  <p>A relative reference that begins with two slash characters is termed
  a network-path reference; such references are rarely used.  <strong>A
  relative reference that begins with a single slash character is
  termed an absolute-path reference</strong>.  A relative reference that does
  not begin with a slash character is termed a relative-path reference.</p>
  </blockquote>
  <p>The only reference to this <code>/\</code> leading sequence that I could find is in the following post :
  <a href="http://www.asp.net/mvc/overview/security/preventing-open-redirection-attacks" rel="nofollow noreferrer">http://www.asp.net/mvc/overview/security/preventing-open-redirection-attacks</a></p>
  <ol>
  <li>Do you have any explanation on why Chrome and IE interprets those URI as absolute ?
  Does it serve any purpose ?</li>
  <li>Apart from protocol relative URI (<code>//example.com</code>), do you know any other &quot;relative&quot; URI which are in fact interpreted as absolute by some browsers ? (being a correct interpretation or not)</li>
  </ol>
  <p><strong>Updated</strong></p>
  <ul>
  <li>Official bug report entered for Chrome :</li>
  </ul>
  <p><a href="https://code.google.com/p/chromium/issues/detail?id=500610" rel="nofollow noreferrer">https://code.google.com/p/chromium/issues/detail?id=500610</a></p>