Is it a problem when URLs in a web application redirect to the URL specified in the
It's not an open redirect like any of the
/whatever?url=evil.com examples I've seen, that can be exploited by having users click on a link to the legitimate application (or at least not as straightforward). This answer seems to indicate (toward the end) that referrers cannot be arbitrarily forged -- at least not without help from the user, in which case the redirect is probably not a problem.
MSA-15-0019 (related blog post) seems to be what I'm asking about, but it's not explained why it is a problem. As far as I understand it's more likely that the addition of the
Referer URL to the button shown on the page resulted in a potential reflected XSS vulnerability.
Note that this is not about possible CSRF issues in any URL that doesn't show a response but instead is likely to act on input in some way; but specifically about the
Location header redirect to the
Referer URL. Is that a problem? If so, how/why?
If it matters, the application is written in Java, and the code I'm concerned about is basically equivalent to
myHttpServletResponse.sendRedirect(myHttpServletRequest.getHeader("Referer")). Assuming nothing else of interest happens on the server as a result of this request, how can it be a problem?