azd · Extension redirect trust boundary prototype

Hiyo Shin · Senior designer at Core AI

Cross-website redirect

Show the original and final URL, explain the trust decision, and default to No.

Confirmation

>_ azd

PowerShell

PS C:\workspace> azd extension install https://short.example/contoso-tools.zip

Download redirects to a different website: https://downloads.example.net/contoso-tools.zip

? Trust the new destination and continue? (y/N)

--no-prompt is not consent. Fail with a specific recovery path.

Error

>_ azd

$ azd extension install https://short.example/contoso-tools.zip --no-prompt

ERROR: Extension redirects to a different website

https://downloads.example.net/contoso-tools.zip

To approve the redirect automatically, run again with --force.

The user experience follows the security boundary.

1
Different hostname Show the destination and ask for confirmation. Default to No.
2
HTTPS → HTTP Show the insecure destination in red and ask for confirmation. Default to No.
3
--no-prompt Fail, show the destination, and explain how to approve with --force.
4
--force Approve the redirect automatically, show a warning, and continue.

Supporting behavior

Show the redirect destination by default, and never forward credentials across a host boundary.