Open Redirect

What it is

Open redirect vulnerabilities occur when an application accepts a user-supplied URL as a redirect target without validating that it belongs to a trusted domain. Attackers exploit this to redirect victims to phishing pages, bypass SSRF filters, or steal OAuth authorization codes by redirecting the victim to an attacker-controlled callback URL.

Attack Vectors

• Login/logout redirect parameters (?next=, ?redirect=, ?url=)
• OAuth redirect_uri parameters
• Email link tracking systems
• After-payment or post-action redirects

Testing Methodology

1. Find redirect parameters (next, redirect, url, return, returnTo, forward)
2. Submit an external URL: ?next=https://evil.com
3. Test bypass techniques: //evil.com, ///evil.com, https:evil.com
4. Try URL encoding: %2F%2Fevil.com, %252F%252Fevil.com
5. Test for OAuth redirect_uri manipulation to steal auth codes

Indicators of Vulnerability

• Browser redirected to external attacker-controlled domain
• Authorization code or access token appears in attacker's server logs
• Redirect occurs without validation of target domain

Detection Guidance

Validate redirect targets against an allowlist of trusted domains. Log all redirect parameter values and monitor for external domain redirects.

Mitigation & Remediation

• Validate redirect targets against an allowlist of trusted domains
• Use indirect reference maps for post-action redirects instead of user-supplied URLs
• For OAuth: strictly validate redirect_uri against pre-registered exact values
• Display a warning page before redirecting to an external URL

References

• OWASP Unvalidated Redirects
• PortSwigger Open Redirect
• OWASP Hunting — Open Redirect (upstream)