4

Suppose you have a redirect page where the client is redirected to a URL from the query string:

http://victim/redirect.aspx?url=http://evil/

You really need to be able to redirect to a another page or URL, how can you prevent this functionality from being exploited?

OWASP says:

It is recommended that any such destination input be mapped to a value, rather than the actual URL or portion of the URL, and that server side code translate this value to the target URL.

Could somebody explain this with an example please?

4

Don't provide the actual URL as an argument to the script. Instead, provide some ID which you can translate into a URL in the redirector script.

For example use redirect.aspx?url=1 instead, and in the script, translate ID 1 to some URL using a map, database lookup, or whatever you find useful.

This way, only a fixed set of trusted URLs can be redirected to.

3

An open redirect means that the redirect value can be determined on the fly.

What is being recommended is to have only a predefined allowed list. You have a mechanism to either allow an authorized user to enter the URL or perhaps this is an automatic function of a CMS or web app that looks for outbound links and then creates the entry. You determine what criteria is required for a person or automated process to "add" a link, you may also filter or blacklist at the time this is happening.

On the server side, you would then have a database. You would add to the database at least an id and the actual URL. You may decide to do something other than just id numbers in order, maybe using some function to create semi-random numbers in order to prevent enumeration by simply incrementing the id value. Something like

| id | real_url    | shortcode |
--------------------------------
| 1  | example.com | X3DFE     |
| 2  | example.net | G4TG      |

You may then have a URL like: example.com/out?shortcode=X3DFE you process this on the server side and then issue a redirect to real_url if the shortcode is not in the lookup table, you provide an error message saying its invalid.

So on the server side something like:

$shortcode = filter_function($_GET['shortcode']);
$url = sql_select_function("SELECT 'real_url' FROM url_table WHERE shortcode ='" . $shortcode . "');

header("HTTP/1.1 301 Moved Permanently"); 
header("Location: " . $url . ""); 

The specifics will obviously depend on your language and other tasks you want to accomplish.

Your database may also include other information, you may require moderation for user submitted links or you may want to include the user who created the links. You could also record hit counts, etc.


The key concept is that you use some mechanism to predetermine the list and make sure the redirect decision is made on the server side. The idea is to create a whitelist of allow redirects.

I would recommend looking into how some URL shorteners work as its similar concept and can provide some useful code in your target language.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.