Reply #111: He's partially right, in that the problem is real, and is inside google

[Moochy]

Another poster below found the google side of the issue, and it's real.

http://clsc.net/research/google-302-page-hijack.htm#012

Recommended fix
This can not and should not be fixed by webmasters. It is an error that is generated by the search engines, it is only found within the search engines, and hence it must be fixed by the search engines.

The fix I personally recommend is simple: treat cross-domain 302 redirects differently that same-domain 302 redirects. Specifically, treat same-domain 302 redirects exactly as per the RFC, but treat cross-domain 302 redirects just like a normal link.

Meta redirects and other types of redirects should of course be treated the same way: Only according to RFC when it's within one domain - when it's across domains it must be treated like a simple link.

Added: A Slashdot reader made me aware of this:

RFC 2119 (Key words for use in RFCs to Indicate Requirement Levels) defines "SHOULD" as follows:

3. SHOULD This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.

So, if a search engine has a valid reason not to do as the RFC says it SHOULD, it will actually be conforming to the same RFC by not doing it.

"Hardly a recommendation for your computer security practices/knowledge. " :rofl:

from http://clsc.net/research/google-302-page-hijack.htm#012