I am currently working on an application that requires authentication for some pages. In order to be nice to our users we provide the ability to specify a redirect url to which the user is returned after logging in.
In order to avoid the open redirect vulnerability we want to make sure this URL is internal.
Right now we do the following:
- Disallow any strings with characters other than
- Always prepend our full base url (
https://www.example.com/) before the user provided content. So even if the user sends us
https://www.evil.comand it wouldn't already be blocked by step 1 it will end up as
However due to required frontend functionality we would also like to include
# as a whitelisted character in step 1.
An example would thus be:
Does this open up any possibilities for open redirects?