What Is an Open Redirect Vulnerability?

What an Open Redirect Is

An open redirect is a URL parameter on your site that redirects users to any external URL without validation:

https://yoursite.com/redirect?next=https://evil.com/phishing

If your server issues a 302 redirect to whatever URL is in next=, an attacker can craft links that start on your trusted domain but end on a malicious site.

Why Attackers Use Open Redirects

• Phishing: victims see a URL from a trusted, recognisable domain before the redirect
• OAuth abuse: some OAuth flows accept redirect_uri from the same domain — an open redirect can redirect tokens to attacker-controlled endpoints
• SSRF bypass: some SSRF filters block direct attacker URLs but allow redirects from trusted domains
• Reputation laundering: spam filters are less likely to flag links to trusted domains

Real-World Example

https://accounts.google.com/ServiceLogin?continue=https://evil.com

(Google does validate its continue parameter — this is an example of the pattern, not a current vulnerability.)

Prevention

1. Avoid redirecting to user-supplied URLs entirely when possible
2. Use an allowlist: only redirect to known, trusted domains or paths
3. Validate the URL: strip scheme, check against allowed origins
4. Use relative paths: /dashboard instead of https://yoursite.com/dashboard
5. Display a warning page: "You are leaving our site, click to continue" for unavoidable external redirects
6. Reject URLs with unexpected schemes: block javascript:, data:, vbscript:

In the Context of SSRF

Open redirects in internal services can be chained with SSRF to bypass IP-based blocklists. The SSRF payload points to a trusted server that then redirects to the internal target. Always re-validate the destination after following redirects.