OWASP Periodic Table of Vulnerabilities - URL Redirector Abuse
URL Redirector Abuse
Root Cause Summary
Applications accept arbitrary user-defined URLs as input, which are then used as targets for redirection. Users may be unwittingly rerouted to a malicious site from a site they trust.
Browser / Standards Solution
Generic Framework Solution
The framework should expose a configurable white list of hosts and/or paths that are acceptable targets for URL redirection. This might include additional rules about stripping fragments and URL parameters from the redirection target. The default rule set should allow only relative URLs, in order to prevent redirection away from the original site.
Session expiration code and code which handles unauthenticated deep linking should automatically apply the white list when attempting to redirect back to a requested URL after successful authentication.
Custom Framework Solution
Custom Code Solution
Discussion / Controversy