---
id: NET-3
family: RT-NET
level: extended
profiles: [runtime]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/rt-net/net-3
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# NET-3 — The redirect posture is stated, not inherited

*RT-NET (Part II) · level: extended · profiles: runtime · added in 1.0*

These restate what most HTTP clients already default to, deliberately: the posture is a decision, not whatever the client happens to ship.

## The rule

> **Normative.** This is the rule.
>
> 1. Outbound requests follow at most 5 redirects.
>
> 2. A redirect of a POST degrades to GET rather than preserving the method.
>
> 3. The originating URL and its query string are never sent to the next host as a referrer.
>
> 4. Hops are restricted to `http` and `https`, so the scheme check cannot be sidestepped mid-chain.
>
> 5. Where a node is configured to permit internal requests, the per-hop check is dropped exactly as the initial check is (a node allowed to talk to the internal network may also be redirected within it), but the hop limit binds either way.

## Related rules

- Names: NET-1, NET-2
- Referenced by: NET-1

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.