Web SecurityLowUnvalidated redirect
Open Redirect
A redirect parameter accepts arbitrary destinations, aiding phishing and token theft.
Overview
When a redirect target comes from user input without validation, attackers craft trusted-looking links that bounce victims to malicious sites or leak OAuth tokens via the redirect.
How it works
When a redirect target comes from user input without validation, attackers craft trusted-looking links that bounce victims to malicious sites or leak OAuth tokens via the redirect.
Example
Impact
Phishing credibility, OAuth/token leakage, and SSRF/filter-bypass chaining.
Detection
Fuzz redirect-shaped params (next, url, return, redirect_uri) with external and bypass payloads; confirm the Location header.
Prevention
- Allowlist redirect destinations or use relative paths only.
- Map redirect targets to server-side keys rather than raw URLs.
- Strictly validate OAuth redirect_uri against registered values.