Are open redirects a security concern?

Question

Are open redirects a security concern? Google writes that: "An open redirect isn't a bug or a security flaw in and of itself—for some uses they have to be left fairly open." And Google's bounty program doesn't view it as a bug:

Some members of the security community argue that open redirectors are a security issue. The common argument in favor of this view is that some users, when presented with a carefully crafted link, may be duped into thinking that they will be taken to a trusted page - but will be not be attentive enough to examine the contents of the address bar after the redirection takes place.

Should open redirects be treated as bugs?

Answer 1

YES, and its an OWASP top 10 violation: OWASP A10 - Unvalidated Redirect. These are valuable for phishing and spam. Recently it was uncovered that spammers where exploiting Open Redirect vulnerabilities on US .gov websites for profit.

Answer 2

No, there are perfectly valid uses for such redirects like URL shortening services.

However one shouldn't use them just "because they can" in most cases there are better alternatives which should be preferred.

It should be regarded as undesirable and only used where that is the only method available.

Answer 3

There is no reason for using redirects on the website if it's not a public redirector. You cant pass any user-made data into response header and obviously allowing to change Status to 301 or 302 and setting up Location is totally fatal.

For avoiding such issue, it should not happen upon Location field submitted by the user, but the field should be generated from the server, and the user is supposed to be identified in sessionid, and the user session should be stored on the server. And this is it.