Open Redirect

Also Known As

TL;DR

Explanation

An open redirect lets an attacker craft a URL on your trusted domain that immediately redirects to a malicious site. Because the initial URL appears legitimate (e.g. yourbank.com/login?next=evil.com), victims are more likely to click it. Attackers use open redirects in phishing campaigns and OAuth token theft. Mitigation: validate redirect targets against an explicit allowlist of permitted paths, or restrict to relative URLs only.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Using $_GET['redirect'] or $_GET['next'] directly in header('Location: ...') without validation.
• Validating that the URL starts with your domain using strpos() — trivially bypassed with your-domain.evil.com.
• Allowing protocol-relative URLs (//evil.com) which browsers interpret as full redirects.
• Forgetting that JavaScript redirects (window.location) are equally exploitable if fed from user input.

Code Examples

// Redirects to any URL the user provides
$url = $_GET['next'];
header('Location: ' . $url);

// Allowlist approach
$allowed = ['/dashboard', '/profile', '/orders'];
$next    = $_GET['next'] ?? '/dashboard';
$target  = in_array($next, $allowed, true) ? $next : '/dashboard';
header('Location: ' . $target);

// Or validate it's the same host
$parsed = parse_url($next);
if (!empty($parsed['host'])) { $next = '/dashboard'; } // reject absolute URLs

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
• ↗ https://cwe.mitre.org/data/definitions/601.html

Tags

Related Terms