I have an ASP.NET MVC website that is using Identity for authentication. It runs in IIS 8.5 as HTTP but has SSL terminated at the Load Balancer and is HTTPS for everything between the browser and the Load Balancer.
Here are the certificate details:
My website does an AJAX POST request to a controller action and the controller action returns a JSON response containing a
window.location.href to the value of this property.
Is it possible for this value to be manipulated so that a user of the website can be redirected to a different URL without their knowledge?