An open redirect lets an attacker use a trusted website to send users to an arbitrary external destination. The link appears to come from your domain, but the user ultimately reaches a site chosen by the attacker. section 14.11
A trusted link becomes a phishing route
A spammer places a link to breddit.com in an email, adding a redirect destination of burnttoast.com. Spam filters may trust breddit.com, while a user who clicks is sent to the attacker’s harmful site and may download malware. section 14.0 section 14.11
The risk commonly appears in login flows that preserve a user's original destination. If the application accepts any destination, attackers can place that redirect in phishing links. section 14.11 section 14.14
Defend redirect endpoints with practical checks:
- Allow relative paths beginning with a single slash, such as /dashboard. section 14.12
- Reject protocol-relative paths beginning with //, which browsers interpret as absolute URLs. section 14.12
- Prefer redirects to pages on your own site; when an external destination is necessary, verify the HTTP Referer header matches your application. section 14.14
import re
from flask import request, redirect
@app.route('/login', methods=['POST'])
def do_login():
username = request.form['username']
password = request.form['password']
if credentials_are_valid(username, password):
session['user'] = username
original_destination = request.args.get('next')
if is_relative(original_destination):
return redirect(original_destination)
return redirect('/')
def is_relative(url):
return url and re.match(r"^\/[^\/\\]", url)
A compact Python and Flask login example validates the next parameter with a regular expression before calling redirect. section 14.12
