11

Lets say I have a website at https://example.com/test. Whenever someone accesses this site, I want to just simply redirect them to https://example.com/Test.

Are there any possible vulnerabilities here? Or is this method safe since all I am doing is redirecting from one secured site to another?

| improve this question | |
  • 2
    Is it just one redirect from one site to another, or are you hinting at some sort of rule for how you redirect depending on upper and lower case? – Anders Apr 12 '18 at 9:16
  • 22
    You ask about "another site", but this generally looks like the same site. – chrylis -cautiouslyoptimistic- Apr 12 '18 at 15:15
  • 34
    You ask "another site", but give same-site examples. Can you clarify which you mean? – Ethan Kaminski Apr 12 '18 at 15:32
  • 7
    To expound on @chrylis and EthanKaminski's comments, the term "site" is generally used to refer to a domain, while "page" refers to a particular address. So https://example.com/test and https://example.com/Test are different webpages on the https://example.com site. – Acccumulation Apr 12 '18 at 18:13
  • You may be interested in this method: history.replaceState(null, document.title, 'Test'); – Patrick Roberts Apr 13 '18 at 2:26
30

/test and /Test are both hosted on example.com … so it's just a page redirect not a domain redirect … this is a non-issue.

People redirect like this all the time, for instance redirecting from HTTP to HTTPS is pretty much industry standard at this point.

| improve this answer | |
  • 1
    The exception would be if a domain has been subdivided. E.g. user1 has control over example.com/user1 and subdomains, user2 has control over example.com/user2 and subdomains, etc. And theoretically, if the string "example.com/test" is generated dynamically, that could open an injection vulnerability. – Acccumulation Apr 12 '18 at 18:18
  • maybe? but a redirect doesnt automatically grant you permission ... if I get redirected from /index.html to /superTopsecretKittys.html ... im still going to get a 401 Unauthorized – CaffeineAddiction Apr 12 '18 at 20:14
  • Yes, but it raises phishing issues. If I can get do an injection attack that gets a website to redirect users to my website, then I be like "Whoops, there's an error, you need to re-enter your credentials". – Acccumulation Apr 12 '18 at 20:26
  • 5
    thats a completely different issue ... if you inject something into someones website ... they have bigger problems then a simple redirect. – CaffeineAddiction Apr 12 '18 at 22:21
  • I wouldn't mention HTTP to HTTPS here. There are some weak spots in doing so that aren't relevant to the OP's description. – jpmc26 Apr 13 '18 at 8:42
18

Implemented correctly, there are no issues with this.

There are two things you should look out for (I assume that test is not static here, but user supplied, so you eg want to upper-case every path):

  • Open Redirect: If your redirect is implemented incorrectly, it might be possible for an attacker to redirect outside of your domain, which could be used in phishing attacks
  • CSRF: If your CSRF protection is only a simple referer check (which isn't recommended), and if you have state-changing GET requests (which also is not recommended), those may be possible to exploit, depending on your implementation of the redirect mechanism
| improve this answer | |
9

Redirecting users to different page or domain is a normal practice followed by many developers (even MNC's including FB, fb.com redirects to facebook.com). It's no harm if you try to redirect requests in a secure way.

You might want to check OWASP Cheat Sheet for Unvalidated Redirects and Forwards (Also called Open Redirection). This document provides to secure ways to redirect URL in multiple programming languages.

| improve this answer | |
1

As far as hostname remains same and your user trust it. It should not be a problem.

This sort of redirection are common across internet and help to provide a better user experience.

For instance:

you have a resource at https://testwebsite.com/Test but due to some typo or developer's mistake it is written as https://testwebsite.com/test. The redirection will help user to see an appropriate file instead of seeing a 404 file not found error or Internal server error.

| improve this answer | |
-4

  1. Redirect within the same domain - no risk. (because your domain is trusted)

    Example: https://domain.com/login redirect to https://domain.com/dashboard

  2. Redirect to third party website is medium severity risk if you are leaking sensitive data like access_token, secret keys to the third party website.

    Example: https://domain.com/redirect_to_fb redirect user to https://fb.com

  3. Attacker controlled redirect leads to:

    a. Phishing https://domain.com/login?redirect_to=http://evil.com

    b. Cross Site Scripting (XSS) issue: https://domain.com/login?redirect_to=javascript:alert(document.cookie)

    c. Leaking tokens Example: https://domain.com/login?redirect_to=https://attackerdomain.com Example: https://r0rshark.github.io/2015/09/15/microsoft/

    d. Content Security Policy bypass

    e. Referrer check bypass

    f. URL whitelist bypass

    g. Angular ng-include bypass

If an attacker is able to control the redirect then it's a serious issue.

| improve this answer | |
  • Sadly the edit does not improve the answer. – Bent Apr 12 '18 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.