What is a forged redirect? (in the context of javascript's fetch API)

Question

I'm trying to make sense of the docs located at:

https://developer.mozilla.org/en-US/docs/Web/API/Response/redirected

It says

Note: Relying on redirected to filter out redirects makes it easy for a forged redirect to prevent your content from working as expected. Instead, you should do the filtering when you call fetch(). See the example Disallowing redirects, which shows this being done.

and

Because using redirected to manually filter out redirects can allow forgery of redirects, you should instead set the redirect mode to "error" in the init parameter when calling fetch(), like this:

Is it really possible to forge the redirected property on a fetch response somehow and how is that done? If not then what vulnerability is this talking about?

• Greg Burghardt: This might be in reference to Server Side Request Forgery attacks although I would need to do more research on this topic.
• Greg Burghardt: I don't think they are talking about faking the redirected property. I'm pretty sure they are talking about some sort of vulnerability in how servers redirect some requests, although I'm not sure how disallowing redirects is safer than checking this in your code...
• Laiv: Response.redirect is not what gets forged, it's request redirections. fetch() options also supports the property redirect which sets the strategy (allow/follow redirects, reject or manual handling). The post is aiming you to don't check/assert redirections when they already happened, instead choose the proper strategy when calling fetch()
• PHP Guru: @Laiv What does that mean when you say request redirections get forged?
• Laiv: Browser#fetch sends a request to point A, but it gets a response generated by point Z. Browser's response object informs about this redirection via Response.redirected. In other words, by the time the browser gets the response, all the redirections (if any) already happened. In other to avoid fetching responses generated by redirections, fetch() implements different redirection policies. One of them (error) will reject any response generated by redirections.