Skip to content

outward

Where does this redirect go?

Open redirects, and the three ways a leading slash is not enough.

Every sign-in flow has a next, and every next is a place the request tells you to send somebody. An open redirect is worth having because the link starts on your domain: it survives a glance at the address bar, and it survives most link filters.

The check everybody writes is whether the target starts with a slash. It is nearly right, and the gap is one character wide.

  • GET /oauth/return?next=%2Fhooks%3Ftab%3Dtest

    A relative path. Both builds send you there.

  • GET /oauth/return?next=%2F%2Fevil.test%2F

    Also starts with a slash. Compare the location header each build sent.

This build

hooks.example.com

Nothing sent yet. Every request goes to the application in this tab and nowhere else.