Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to check if the returnUrl is located on same server as the web application?

So far I figured out, that there are two ways how atacker can redirect user elsewhere and following actions can be performed to prevent these attacks:

  1. Attacker supplies whole URL in the parameter (http://evil.com/) - here it is possible to check if parameter contains http(s):// or ftp://
  2. Browser automatically adds the protocol if it is missing, so attacker can provide something like //evil.com or //numeric_ip_address and it will redirect user outside the server too - here you can still check if URL starts with the //

Are there any other ways to encode URL address? Can I be sure that the parameter cannot be misused if I check only previous two cases?

share|improve this question
    
there are additional ways to obfuscate the address, such as htp:// or even ht:// or hp://. It can be encoded, the site can be given as DWORD, and there are more. –  AviD Nov 22 '10 at 12:36
add comment

3 Answers

up vote 6 down vote accepted

One way you could approach this would be to encrypt the parameter as it's passed to the user with a key stored on the server (also for better protection consider adding a HMAC). Then when the user submits the form, decrypt the parameter (and check the HMAC if used) and use it to redirect the user.

I've seen cases where the URL is just obfuscated (base64 encoding etc). That might deter casual attackers, but I wouldn't rely on it, as a determined attacker is likely to work out the scheme used.

share|improve this answer
    
This is a good suggestion, but in this situation we need data authentication, not encryption. HMAC is a good suggestion. However, encryption doesn't provide data authentication (in general), and so encryption alone is not sufficient. –  D.W. Feb 20 '12 at 1:20
add comment

You can add your website's prefix onto the url so they would go to:

example.com/login.php?returnurl=profiles/home.php

And in the page you would have it return to http://example.com/ and add of the return URL. (http://example.com/RETURNURLHERE)

share|improve this answer
1  
I personally like this approach. Solves the problem, and the added benefit of a shorter and cleaner and more readable URL. –  George Bailey Dec 23 '11 at 15:05
add comment

There are many ways to attack a user/browser or obfuscate URLs/redirects. Crazy way's that will make your brain hurt and leave you asking why does that work?! (see: http://code.google.com/p/browsersec/) In general, when validating input, don't try to fix the data, if its not what you expected or not in the format you required, throw it away. Remember default deny, this is just another example of that.

Like anything, how you implement this, is dependent on your requirements. You also should be aware of implementation flaws when handling redirects that can also open up further vulnerabilities such as HTTP response splitting, Header injection, etc.

I usually recommend a combination of destination whitelisting and request signing (using HMAC, similar to Rory's suggestion). When preforming request signing, I like to make the destination visible in the URI. For example:

http://yoursite.com/login.php?returnurl=welcome.php&hash=yourlonghashhere

That allows the user to have a little viability into where the request should go, and also allows for more savvy users to possibly notice a phishing or other attack on their own.

When a redirect is about to occur:

  1. Verify the 'returnurl' against the hash
  2. Verify the 'returnurl' is whitelisted
  3. Then preform the redirect.

If any step of the validation process fails, either redirect to a default/home page or reject the request.

Here are some more resources:

share|improve this answer
    
Excellent answer! –  D.W. Feb 20 '12 at 1:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.