Redirect only to your own pages

How to do it

Accept only paths that start with a single /, or IDs that map to known targets. Reject full addresses, //host, backslashes and control characters. Attackers use open redirects to make phishing links look trusted.

Examples

Plain text example

/login?next=https://evil.example.net
/login?next=//evil.example.net
/login?next=/\evil.example.net
/login?next=/%09/evil.example.net

JavaScript example

const isSafeNext = next => typeof next === 'string' && /^\/(?!\/)/.test(next) && !/[\\\x00-\x1f]/.test(next);
res.redirect(isSafeNext(req.query.next) ? req.query.next : '/');

Python example

def is_safe_next(target: str) -> bool:
    return (target.startswith("/") and not target.startswith("//")
            and not any(ch == "\\" or ord(ch) < 32 for ch in target))

return redirect(target if is_safe_next(target) else "/")

How to check

The agent sets the return address to an outside site in several forms. Every one lands on the home page or an error.

Sources

• OWASP Unvalidated Redirects and Forwards Cheat Sheet

Related rules

• WEB-81 Keep every old address in one redirect map in Website
• WEB-85 Use the right redirect code in Website
• EML-57 Send only links people can trust in Email
• TNS-19 Check links in user content against phishing and malware lists in Trust and safety