"<a href="http://evilsite.com#/about http://evilsite.com#/about">About</a>" There is absolutely no reason to build links with your own hostname in them in the

"<a href="http://evilsite.com#/about http://evilsite.com#/about">About</a>" There is absolutely no reason to build links with your own hostname in them in the first place. Why on earth would you make a link like this instead of href="/about"? edited to add: the spec says that the Location header for a redirect must be an absolute URI, so that's one case where you'd need to know your hostname. But you certainly don't need it to build links.