#barnabywaltersaaronpk: the redirect following algorithm in load_page is only used for determining what page to fetch to parse for rel-me links and whether or not that page is secure, *not* for determining the final rel-me URL used to authenticate the user, right?
#aaronpkcorrect. actually the rel-me URL used to authenticate the user is always whatever they entered in the form
#barnabywalterslater on I’ll try to write a basic test suite and try to get a PHP implementation of rel verification working
#barnabywaltersthe bit I’ve found most difficult to understand is the fact that redirected URL resolution is *slightly* different for going from a rel-me-url to final rel-me url, and going from a profile-url to final-profile URL
#barnabywaltersas the second one has the “is the redirect insecure but the rest of it matches” step
#barnabywaltersalthough, the comparison is actually exactly the same
#barnabywaltersit’s just that for the second case, indieauth only warns the user if no URLs succeeded
#barnabywaltersif no rel-me backlinks matched AND one of the links was an insecure redirect but otherwise matched, then let the user know how to fix it
#barnabywaltersargh, that while loop’s in a block. what’s the scope of a return statement within a block?