Security Check n°12 / 120

Open redirect protection

An open redirect is a flaw that allows an attacker to use a trusted site's URL to redirect visitors to a malicious site. For example: yoursi…

Analyse my site for free
← All checks

Understanding "Open redirect protection"

An open redirect is a flaw that occurs when a page accepts a destination URL parameter (?next=, ?url=, ?redirect=…) without verifying it points to your own domain. An attacker can craft a link like https://yoursite.com/logout?next=https://evil.com: the visitor sees the legitimate domain name at the start of the URL and trusts it, but ends up redirected to a third-party site.

This flaw appears in common web vulnerability classifications because it is simple to exploit and particularly effective for phishing: trusting a link that starts with a known domain is a human reflex that awareness training alone struggles to override.

❌ Open redirect
🔗 yoursite.com/logout?next=evil.com
→ trusted click →
🎣 evil.com (fake site)
✅ Validated redirect
🔗 yoursite.com/logout?next=evil.com
→ parameter rejected →
🏠 yoursite.com (default page)

How TheSiteFuse checks "Open redirect protection"

TheSiteFuse tests 5 URLs built with common redirect parameters pointing to a fictitious external domain (/logout?next=, /redirect?url=, /?next=, /redirect?to=, /out?url=, all suffixed with https://evil.com). For each redirect-type HTTP response (301, 302, 303, 307, 308), the Location header is analysed: if it points to an external domain (different from the audited domain), the check fails.

Why "Open redirect protection" matters

An uncorrected open redirect can be exploited in several ways:

  • Credible phishing — the attacker sends an email or message with a link that genuinely starts with your domain, bypassing usual vigilance and some reputation-based anti-phishing filters.
  • OAuth token theft — if your site implements third-party authentication (Google, Facebook…), an open redirect can sometimes be combined with the OAuth flow to intercept access tokens.
  • Security filter bypass — some tools block links to unknown domains but allow links to trusted domains, even if those domains then redirect elsewhere.
  • Reputation damage — your domain may be flagged and blacklisted by anti-phishing tools if it is used as a relay in malicious campaigns.

Fix "Open redirect protection" step by step

General principle: never trust a redirect parameter supplied by the user. Always validate it server-side.

Flask — safe redirect

from urllib.parse import urlparse

def is_safe_url(target, host):
    ref = urlparse(request.host_url)
    test = urlparse(urljoin(request.host_url, target))
    return test.scheme in ('http', 'https') and ref.netloc == test.netloc

next_url = request.args.get('next')
if next_url and is_safe_url(next_url, request.host):
    return redirect(next_url)
return redirect(url_for('index'))

Recommended approach: allowlist

Rather than accepting an arbitrary URL, use a short identifier (?next=dashboard) that you explicitly map to a known internal URL server-side. This is the most robust solution: no external URL can ever be injected.

Simple alternative: only accept relative paths starting with / and reject any parameter containing :// or starting with // (which browsers interpret as an absolute URL).

Reference resource

To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.

Wikipedia — Open redirect protection

Does your site pass this check?

Run the free full audit (120 checks) and instantly discover what needs fixing.

Continue with Google
or