Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are open redirects a security concern? Google writes that: "An open redirect isn't a bug or a security flaw in and of itself—for some uses they have to be left fairly open." And Google's bounty program doesn't view it as a bug:

Some members of the security community argue that open redirectors are a security issue. The common argument in favor of this view is that some users, when presented with a carefully crafted link, may be duped into thinking that they will be taken to a trusted page - but will be not be attentive enough to examine the contents of the address bar after the redirection takes place.

Should open redirects be treated as bugs?

share|improve this question
add comment

3 Answers 3

up vote 14 down vote accepted

YES, and its an OWASP top 10 violation: OWASP A10 - Unvalidated Redirect. These are valuable for phishing and spam. Recently it was uncovered that spammers where exploiting Open Redirect vulnerabilities on US .gov websites for profit.

share|improve this answer
5  
I lol'd so hard at that .gov redirect. Damn that's stupid. –  Polynomial Oct 21 '12 at 12:04
    
@Rook, So are you are saying that all URL shorteners are vulnerable? See security.stackexchange.com/q/59517/2379 –  Pacerier Jun 6 at 16:12
add comment

No, there are perfectly valid uses for such redirects like URL shortening services.

However one shouldn't use them just "because they can" in most cases there are better alternatives which should be preferred.

It should be regarded as undesirable and only used where that is the only method available.

share|improve this answer
1  
-1 This vulnerability can (almost) always be avoided. For instance you can use a session variable to store the URL. Read the prevention section on the OWASP A10 page. –  Rook Oct 21 '12 at 19:23
    
I stated that in my answer, it is very rare that one does need any such redirect, but there is the odd valid case. –  ewanm89 Oct 21 '12 at 23:49
add comment

There is no reason for using redirects on the website if it's not a public redirector. You cant pass any user-made data into response header and obviously allowing to change Status to 301 or 302 and setting up Location is totally fatal.

For avoiding such issue, it should not happen upon Location field submitted by the user, but the field should be generated from the server, and the user is supposed to be identified in sessionid, and the user session should be stored on the server. And this is it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.