> refresh: 0; URL=javascript:alert(document.cookie) > The code will work in context of this site. ...which happens to be covered here for half a year or so: http://code.google.com/p/browsersec/wiki/Part2#Redirection_restrictions I can't see how this could be a vulnerability per se, although changing the behavior offers an additional, if small, degree of protection in case of security lapses in web applications, so it's a reasonable improvement. Cheers, /mz
