The HTTP 303 SSRF Hack : From Python HTTP Client Defaults to AWS Credential Exfiltration.

A POST to IMDS may fail — but a redirect can quietly turn it into something else.