Agent WranglersRequests and files Required
Redirect only to your own pages
A redirect that takes its target from the address must only go to your own pages or an allow-list.
How to do it
Accept only paths that start with a single /, or IDs that map to known targets. Reject full addresses, //host and backslashes. Attackers use open redirects to make phishing links look trusted.
Example
/login?next=https://evil.example.net
/login?next=//evil.example.net
/login?next=/\evil.example.netHow to check
The agent sets the return address to an outside site in several forms. Every one lands on the home page or an error.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/block-open-redirects.