In redir.php:

header("Location: {$_GET['addr']}");

For fixing open redirect vulnerability i can think of several ways:

1- (Side effect of) Using a security token (anti-csrf token):

if(!isset($_SESSION['anticsrf_token'], $_GET['anticsrf_token']) or $_SESSION['anticsrf_token']!==$_GET['anticsrf_token']) exit('...');

This should work because an attacker cannot know and cannot create a valid anti-csrf token.

2- Comparing the domain of the 'redirect to address' with that of the script (redir.php) itself ($_SERVER['HTTP_HOST']).

3- The 'redirect to address' first can be stored by the referring script (the script that contains the link to redir.php) in the $_SESSION and then redir.php acts only on that session var:

header("Location: {$_SESSION['redir2addr']}");

A cookie can be used instead of session too.

I can think of some other ways too, but seems one of these is sufficient for my own app. I will appreciate any ideas and gotcha u know or can think of.


I would go with the second approach (HTTP_HOST is user controlled, but it doesn't matter in this case). It's the easiest to use, and it's pretty much impossible to mess up.

The first and third approach are harder to use from the calling code (not a security issue, but still bad), and they can also be wrongly used by the calling code (the third one a lot easier than the first one):

if (something the attacker can trigger with GET params) {
    $_SESSION['redir2addr'] = $_GET['addr'];

and (you never know whose going to extent your code...):

if (something the attacker can trigger with GET params) {
    $_SESSION['anticsrf_token'] = 'something';
    $_GET['anticsrf_token'] = 'something';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.