Open Redirect

An open redirect is a vulnerability in which a legitimate website redirects visitors to a URL taken from user input, such as ?next= or ?returnUrl=, without checking that the destination is safe.

Why it matters

A link beginning with a trusted domain looks safe to people and to some mail filters, yet it can send the victim to a look-alike login page elsewhere. Open redirects are also used to bypass allowlists and, in some OAuth setups, to leak tokens. They are usually rated low to medium on their own but become more serious combined with other issues.

Example

A login page redirects to the page given in a parameter after sign-in. A safe implementation only accepts relative paths, or looks the value up in a fixed list:

if not next_url.startswith("/") or next_url.startswith("//"):
    next_url = "/"

Treating // as external matters because browsers read it as a different host.

Common mistakes

• Checking only that the URL contains your domain name, which can be faked with subdomains or paths.
• Forgetting protocol-relative or encoded forms.
• Using full URLs in parameters when a short key would do.
• Ignoring the issue because it is "only a redirect".

Related

• Redirect 301/302
• Phishing
• OAuth
• URL

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.