1

I am currently working on an application that requires authentication for some pages. In order to be nice to our users we provide the ability to specify a redirect url to which the user is returned after logging in.

In order to avoid the open redirect vulnerability we want to make sure this URL is internal.

Right now we do the following:

  1. Disallow any strings with characters other than a-z0-9/=._-
  2. Always prepend our full base url (https://www.example.com/) before the user provided content. So even if the user sends us https://www.evil.com and it wouldn't already be blocked by step 1 it will end up as Location: https://www.example.com/https://www.evil.com.

However due to required frontend functionality we would also like to include # as a whitelisted character in step 1.

An example would thus be:

Location: https://www.example.com/totally-relative-url#magic-that-leads-to-external-redirect.

Does this open up any possibilities for open redirects?

4

The # in a URI denotes a fragment identifier. This is not sent to the server, and therefore cannot be used to cause a redirect without client-side help.

It should be safe to send back to a user, I would be more concerned with the rest of the URL than with the fragment.

  • The fragment is sent to the server and thus back to the client since that is exactly the functionality we require. So the client-side-help is what I am afraid of :) Any other concerns regarding the rest of the URL when using this scheme? – Tim Strijdhorst Feb 15 '18 at 11:41
  • I mean that when the client is redirected to www.example.com/stuff/#fragment, the #fragment is not sent to the server handling www.example.com and therefore cannot trigger a HTTP redirect. It would take special client handling to issue a request based on the value of fragment, but nothing standard exists. – Marc Feb 15 '18 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.