Home / Knowledge hub / Redirect chaining
Knowledge hub
Redirect chaining
Using a harmless redirect to make a phishing or token-theft link look trusted.
What it means
Redirect chaining means using an open redirect on a site people trust to send them somewhere they should not go. The link starts with your real domain, so it passes a quick glance, then your own page forwards the visitor to the attacker's page. Several redirects can be strung together.
On its own, an open redirect looks like a minor flaw. Chaining is what gives it weight: the redirect becomes a building block in a longer route, such as a fake sign-in page or a stolen authorisation code.
Why it matters
Your domain's reputation is the weapon. Email filters, link scanners and careful staff are more likely to trust a link that begins with your name. A phishing message using it gets further, and customers who click may blame you for what follows.
The more serious case involves sign-in flows. If an OAuth redirect target can be bent, a code or token can be delivered to a page the attacker controls, which can end in account takeover. A flaw rated low on its own can become the missing link in a serious chain.
How it shows up
You meet it in parameters named next, return, redirect or url on sign-in, logout, payment-return and tracking links. The usual mistakes are checking only that the target starts with your domain, allowing look-alike hosts, and trusting a redirect that passes through another service you also run.
Fix it by allowing only a fixed list of destinations, or by using internal paths rather than full URLs. Where you must redirect outward, show a warning page first. Test by trying absolute URLs, scheme-relative links, encoded characters and look-alike hostnames, then follow each redirect to the end.
Questions people ask
Redirect chaining, answered
Is an open redirect a serious vulnerability?
On its own it is often rated low. It becomes serious when it helps steal a sign-in code, defeats a link check or makes a phishing link convincing.
Rate it by what it can be chained with, not only by what it does alone.
What does chaining mean here?
It means combining two or more small flaws or behaviours so that together they achieve something none could alone. A redirect on your site plus a weak sign-in return check is a typical pair.
Why does the link look trustworthy?
The part people read, the domain, is yours. The destination is carried in a parameter further along, which few people check.
Link scanners that judge only the first host may pass it too.
How do we stop it?
Do not accept full URLs from the request. Map a short key to a fixed list of destinations, or accept only relative paths that you validate. For OAuth, register exact redirect addresses and reject anything else.
How do we test for it?
Try changing each redirect parameter to an outside address in every form a filter might miss, including encoded and look-alike variants. Then check whether the redirect can be used in a sign-in or token flow.
The proof is the finished chain, not the redirect alone.
Sources
Where this comes from
Related
Terms that sit next to this one
Open redirect
A page that forwards visitors to any address handed to it in the URL.
OAuth redirect URI
The address a sign-in provider sends the user back to, which must be matched exactly.
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Chained vulnerabilities
Several smaller flaws combined to produce a much bigger impact than any alone.
Account takeover
An attacker ends up signed in as one of your real users.
Where does the link really end up?
We follow redirects through to the end and check whether small flaws combine into something that matters. A finding shows the full request chain, not a guess. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.