Open redirect: unsafe redirects

In short: An open redirect exists when a website sends users to an address taken from a request parameter without checking it. Attackers abuse this to steer victims via the trusted site to scam sites.

In more detail: Example: https://shop.example/login?next=https://evil.example. After login the page blindly redirects to next. The link begins with the real domain and looks trustworthy.

In Depth

• Danger: Phishing looks more credible. Login flows (OAuth return addresses) can also be attacked, where codes or tokens reach the target address.
• Defence 1: Allow only relative paths (/account), no full addresses. Beware of //evil.example and /\evil.example, which browsers read as foreign addresses.
• Defence 2: An allow list of permitted targets. Parse the address and compare the host with the list, not “starts with”.
• Defence 3: Pass an identifier instead of the address (?next=account), which the server translates into a path itself.
• Warning page: If external targets must be allowed, show an interstitial “You are leaving this site” first.
• Checking: Try parameters such as next, url, redirect, return_to in tests with foreign addresses.

See also: phishing, OAuth