---
id: NET-2
family: RT-NET
level: core
profiles: [runtime]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/rt-net/net-2
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# NET-2 — Every redirect hop is re-validated before it is taken

*RT-NET (Part II) · level: core · profiles: runtime · added in 1.0*

Pinning binds the original host only. Without this, a public host answering a redirect to a link-local metadata address walks straight past a guard that has already reported success.

## The rule

> **Normative.** This is the rule.
>
> 1. Each redirect target is validated on the same terms as the original URL, before the hop is taken, and a hop resolving into a private or reserved range is refused.
>
> 2. Hops are re-validated, not refused: a redirect from one public host to another (a shortener, a canonical-host bounce, an upgrade to HTTPS) is still followed, so this is no change for workflows that are not being attacked.
>
> 3. The residual window is stated rather than papered over: a hop's host is resolved for the check and resolved again for the request, so per-hop rebinding remains possible where the original request's pinning excludes it.

## Related rules

- Names: NET-1
- Referenced by: INT-20, NET-1, NET-3

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.