We have a web app and we send the back URL through post to various pages to enable users come back to the parent.

The double quotes are translated to " to avoid XSS and then translated back. The final tag is like this - form name="back_url" action="server side script" method="post". These double quotes are creating the "Token contains a reflected XSS vector" error. Once I remove the double quotes like form name=back_url action=server side script method=post , the back button works. This issue is only in Chrome. Not sure how to resolve this.

  • Please could you clarify a bit - Could you add your actual form as code in your question? Why are you converting to quot; and then back again? – SilverlightFox Aug 22 '15 at 7:40

You should use URL encoding not HTML encoding. If you URL encode the back_url parameter the quotes shouldn't trigger any XSS warnings and you won't need to deal with converting them back and forth to make the redirect work correctly.

Also be wary that this design introduces an open redirect vulnerability into your application. An attacker can craft a URL for your website that redirects to an attacker controlled site when they use the back button if you're not properly sanitizing the back_url parameter.

  • Grammar is hard in the morning. : ) – Justin Moore Aug 19 '15 at 14:41
  • URL encoding should only be used in the path and query string parts or the URL. Technically you should URL encode and then HTML encode, however URL encoding usually gets rid of the HTML characters that allow escaping. – SilverlightFox Aug 22 '15 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.