One of my websites has a webpage wherein it has a button/link named 'BACK'. Anyone clicking on this button/link will redirect user to HOME page of the application. Now if the user change the URL on client-side through 'Inspect Element', then the user can be redirected/forwarded to even Google.com. In the process, request is not going to application rather it's going directly to Google.com.

Can anyone let me know if it's a vulnerability or not? I understand that as the link is not validated by the application in any way, it's a vulnerability.

1 Answer 1


It's not a vulnerability because it only affects the user. When you modify something with "inspect element", you are modifying the code in your browser, not in everyone else's browser.

A different thing is an URL-redirect vulnerability. Let's say you have variable in your code that does something like my-fancy-site.com/script.php?site=www.google.com. In this case, people could change the content of the variable and send the link to other people that trusts your domain, so that they will click on it and will be redirected to Google.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .