A10: Unvalidated Redirects and Forwards · 2013

Redirects controlled by unvalidated parameters can send victims to malicious sites or be chained with other attacks.

Summary

Redirects controlled by unvalidated parameters can send victims to malicious sites or be chained with other attacks.

How the attack works

A link to the legitimate site contains an external destination; the application uses it without validation and redirects the person away.

Example

Vulnerable · Pseudocode

GET /leave?next=https://other.example
302 Location: https://other.example

Fix: Map identifiers to permitted destinations; also authorize any internal forward.

Prevention

Accept only validated same-origin paths or explicit destination mapping; reject network-path references like //host.
Do not build redirects directly from user input.
Show clear confirmation when leaving the domain is necessary.

Lineage

2013 · A10: Unvalidated Redirects and Forwards Leaves the Top 10 in 2017

Sources

Open official source ↗

Buy me a coffee