2

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this:

<html><body>
You are being <a href="The link where will redirect">redirected</a>. 
</body></html>

My questions:

  1. Why there is HTML code, if the browsers will redirect it automatically?

  2. If I inject code in href, can a JavaScript code be executed before the redirection happened or not?

  • So basically your question is if a http header redirect can be suppressed via some input to execute code following it? Clients definitely do not have to follow it, so it would be interesting to know if an attacker can force this. Either way, I would HTML encode the input when echoing it. As you describe it, you would also be open to redirect. – tim Aug 29 '15 at 12:47
2

1- why there are html code if the browser will redirect it automatically

It's traditional from the times where 302 was new and not every client understood what it means. It is not really needed today and uselessly wastes bandwidth.

2- if inject code in href, a javascript code can this executed before the redirection happened ? or not ?

If you have a proper 302 response, that is a Location header is present, the body will be ignored and nothing will be executed.

If no Location header is present (which would be an invalid response) it depends on the browser and context: if the URL with the bad 302 was included with img tag or was linked HTML it will often be rendered including the execution of Javascript inside the HTML. In other cases like downloads (link not leading to HTML) or script context it will instead result in an error.

There are firewalls which can be bypassed this way because they don't expect the browser to execute the body of 302 responses and thus skip inspection even if no Location header in the response indicates the target of the redirection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.