Home / Knowledge hub / Open redirect
Knowledge hub
Open redirect
A page that forwards visitors to any address handed to it in the URL.
What it means
An open redirect takes a destination out of the request and sends the visitor there without checking it. The usual shapes are a link such as /go?url=..., or a next parameter on a sign-in page built to return people to where they were.
It is called open because nothing restricts the destination. Put any address in the parameter and the site forwards the visitor, obligingly and without comment.
Nobody builds one deliberately. It arrives because returning a user to the page they came from is a sensible feature, and the destination was never checked against anything.
Why it matters
On its own it touches no data, which is why teams dismiss it. Its value to an attacker is that the link starts with your domain. MITRE makes the point in CWE-601: because the server name in the link matches the real one, the phishing attempt looks more credible.
Your brand persuades the victim and the redirect does the rest. If a customer loses money through a link on your own domain, explaining that the bug was technically minor is not a comfortable conversation.
How it shows up
Look for parameters named url, next, return, redirect, continue or dest, especially around sign-in, sign-out, payment returns and marketing links. Put an external address in one and see where you land.
Partial checks fail predictably. A starts-with-our-domain test falls to an address that begins with your domain and carries on elsewhere, and blocking one encoding leaves another. OWASP recommends mapping a short identifier to an approved destination on the server, which removes the problem rather than filtering it.
Questions people ask
Open redirect, answered
Is an open redirect really a vulnerability?
Yes, and it is a weak one on its own. MITRE lists it as CWE-601, and the impact comes from what it enables rather than from what it does.
Judge it by the phishing email it makes possible, not by the redirect itself.
Why do bug bounty programmes mark it out of scope?
Because the reports are numerous, easy to find and low impact on their own, so some large programmes exclude them to keep the queue usable. Others accept them and pay at the low end.
Out of scope for a bounty is a commercial decision. It does not mean the behaviour is fine on your marketing domain.
How bad is it if no data leaks?
The damage lands on your customers and your reputation rather than your database. A link that begins with your domain gets past both a suspicious recipient and a mail filter checking the visible address.
It also chains. An open redirect on a sign-in flow can help leak an OAuth code to somebody else.
Is checking that the address starts with our domain enough?
No. An attacker registers something that begins with your domain and continues to theirs, and the check passes. Encoding tricks defeat the next attempt.
Prefer a list of approved destinations, or send a relative path rather than a full address.
How do we keep the return-to-page feature?
Store the destination on the server and pass a short identifier in the URL, which is what OWASP suggests. The user gets sent back where they were and the parameter cannot name an outside address.
Where that is too heavy, accept a relative path only, and reject anything containing a scheme or a host.
Sources
Where this comes from
Related
Terms that sit next to this one
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Input validation
Checking that what arrives is the shape and range you expected.
Allowlist
A list of what you permit, with everything else refused by default.
OAuth
The standard behind every sign in with and connect your account button.
SSRF
Making your server fetch a URL of the attacker's choosing.
Would your domain send them away?
Redirect handling sits inside the configuration and authentication testing we run on every application, with the request and the response attached. Start with a 30 day pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.