Open redirect attack
An open redirect attack exploits an application vulnerability that allows users to be redirected to destinations controlled by an attacker.
ASP.NET Core in Action, 3e
An open redirect attack is a vulnerability in which an application redirects a user to an attacker-controlled external URL.
- How it is used
- Protects login and other redirect flows from sending users to malicious external websites.
- How deep it goes
- Explains the attack sequence and demonstrates local-URL validation, while deferring broader redirect implementation details.
- Examples
- Uses an e-commerce login journey, a malicious returnUrl, Url.IsLocalUrl(), and LocalRedirect().
- What you can do after
- Apply Url.IsLocalUrl() or LocalRedirect() to validate redirect destinations before returning users to them.
Read how ASP.NET Core in Action, 3e explains open redirect attack →
Grokking Web Application Security
An open redirect is a web vulnerability in which an application redirects users to an attacker-controlled destination.
- How it is used
- Frames redirects as a way attackers borrow a trusted domain to deliver phishing links and harmful destinations.
- How deep it goes
- Explains the attack path and relative-path defense, then stops short of broader redirect implementation details.
- Examples
- Uses a trusted-domain bounce between breddit.com and burnttoast.com plus a Python Flask next-parameter check.
- What you can do after
- Apply relative-path validation to redirect parameters and review login redirects for unsafe external destinations.
Read how Grokking Web Application Security explains open redirect attack →
Related concepts
- vulnerabilitykind of · A vulnerability is a weakness or susceptibility in a system, process, or person that can expose it to harm, misuse, failure, or compromise.
- relative pathnameaddressed by · A relative pathname identifies a filesystem or resource location relative to a designated base location rather than an absolute root or origin.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.