I am currently working on an application that requires authentication for some pages. In order to be nice to our users we provide the ability to specify a redirect url to which the user is returned after logging in.

In order to avoid the open redirect vulnerability we want to make sure this URL is internal.

Right now we do the following:

  1. Disallow any strings with characters other than a-z0-9/=._-
  2. Always prepend our full base url (https://www.example.com/) before the user provided content. So even if the user sends us https://www.evil.com and it wouldn't already be blocked by step 1 it will end up as Location: https://www.example.com/https://www.evil.com.

However due to required frontend functionality we would also like to include # as a whitelisted character in step 1.

An example would thus be:

Location: https://www.example.com/totally-relative-url#magic-that-leads-to-external-redirect.

Does this open up any possibilities for open redirects?

1 Answer 1


The # in a URI denotes a fragment identifier. This is not sent to the server, and therefore cannot be used to cause a redirect without client-side help.

It should be safe to send back to a user, I would be more concerned with the rest of the URL than with the fragment.

  • The fragment is sent to the server and thus back to the client since that is exactly the functionality we require. So the client-side-help is what I am afraid of :) Any other concerns regarding the rest of the URL when using this scheme? Feb 15, 2018 at 11:41
  • I mean that when the client is redirected to www.example.com/stuff/#fragment, the #fragment is not sent to the server handling www.example.com and therefore cannot trigger a HTTP redirect. It would take special client handling to issue a request based on the value of fragment, but nothing standard exists.
    – Marc
    Feb 15, 2018 at 11:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .