Open redirect protection
An open redirect is a flaw that allows an attacker to use a trusted site's URL to redirect visitors to a malicious site. For example: yoursi…
Analyse my site for freeUnderstanding "Open redirect protection"
An open redirect is a flaw that occurs when a page accepts a destination URL parameter (?next=, ?url=, ?redirect=…) without verifying it points to your own domain. An attacker can craft a link like https://yoursite.com/logout?next=https://evil.com: the visitor sees the legitimate domain name at the start of the URL and trusts it, but ends up redirected to a third-party site.
This flaw appears in common web vulnerability classifications because it is simple to exploit and particularly effective for phishing: trusting a link that starts with a known domain is a human reflex that awareness training alone struggles to override.
How TheSiteFuse checks "Open redirect protection"
TheSiteFuse tests 5 URLs built with common redirect parameters pointing to a fictitious external domain (/logout?next=, /redirect?url=, /?next=, /redirect?to=, /out?url=, all suffixed with https://evil.com). For each redirect-type HTTP response (301, 302, 303, 307, 308), the Location header is analysed: if it points to an external domain (different from the audited domain), the check fails.
Why "Open redirect protection" matters
An uncorrected open redirect can be exploited in several ways:
- Credible phishing — the attacker sends an email or message with a link that genuinely starts with your domain, bypassing usual vigilance and some reputation-based anti-phishing filters.
- OAuth token theft — if your site implements third-party authentication (Google, Facebook…), an open redirect can sometimes be combined with the OAuth flow to intercept access tokens.
- Security filter bypass — some tools block links to unknown domains but allow links to trusted domains, even if those domains then redirect elsewhere.
- Reputation damage — your domain may be flagged and blacklisted by anti-phishing tools if it is used as a relay in malicious campaigns.
Fix "Open redirect protection" step by step
General principle: never trust a redirect parameter supplied by the user. Always validate it server-side.
Flask — safe redirect
from urllib.parse import urlparse
def is_safe_url(target, host):
ref = urlparse(request.host_url)
test = urlparse(urljoin(request.host_url, target))
return test.scheme in ('http', 'https') and ref.netloc == test.netloc
next_url = request.args.get('next')
if next_url and is_safe_url(next_url, request.host):
return redirect(next_url)
return redirect(url_for('index'))
Recommended approach: allowlist
Rather than accepting an arbitrary URL, use a short identifier (?next=dashboard) that you explicitly map to a known internal URL server-side. This is the most robust solution: no external URL can ever be injected.
Simple alternative: only accept relative paths starting with / and reject any parameter containing :// or starting with // (which browsers interpret as an absolute URL).
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — Open redirect protectionDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.