Say you have a web site and you are using some
returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to check if the
returnUrl is located on same server as the web application?
So far I figured out, that there are two ways how atacker can redirect user elsewhere and following actions can be performed to prevent these attacks:
- Attacker supplies whole URL in the parameter (http://evil.com/) - here it is possible to check if parameter contains
- Browser automatically adds the protocol if it is missing, so attacker can provide something like
//numeric_ip_addressand it will redirect user outside the server too - here you can still check if URL starts with the
Are there any other ways to encode URL address? Can I be sure that the parameter cannot be misused if I check only previous two cases?