I have a site located at
which redirects me to
At the server side, the redirect is defined by
String path = request.getparameter("retrunPath"); String rPath = "redirect:/somegoodplace/"+ path; return new ModelAndView(rPath, model);
Is there a payload for 'returnPath' parameter which an attacker can use to redirect an unsuspecting user to https://evil.com.
Is the risk of open redirection completely mitigated with the use of redirect prefix?
Is there any other attack possible with this code? [perhaps XSS as user supplied value gets reflected on the address bar.]