Open Redirects: Small Bugs, Bigger Chains
Open redirects are the 'sure, it's low' finding that becomes medium when chained. Login flows, logout URLs, and `next=` parameters love to bounce users anywhere.
Testers care because users trust the brand domain in the address bar—even as they're sent elsewhere.
Redirect bugs feel small until you sit in a phishing workshop and watch users trust the domain bar. Document user-visible trust impact, not just Location headers.
Where they hide
OAuth callbacks with loose validation, email link trackers, legacy mobile deep links, and JSON fields that become redirect targets server-side.
Some frameworks validate path but not scheme or subdomain tricks.
Impact framing
Token theft via referer leakage, phishing credibility, and SSRF-adjacent fetches if the server follows redirects server-side.
Document whether user interaction is required
Note if javascript: or data: schemes are blocked
Capture a minimal bounce chain
Fixes
Allowlist destinations, use relative paths only with strict parsing, and avoid reflecting raw URLs from query params.
Severity lives in context—write the chain honestly.
Use benign external URLs in proofs unless scope permits otherwise.
When closing redirect bugs, confirm fixes on mobile deep links too—teams often patch web login only.
Small habits compound—what feels like overhead early becomes speed when deadlines hit.
Check redirect behavior on API responses too—not just browser navigation.
Mobile deep links
Custom URL schemes interacting with redirects create confusing behavior on iOS and Android—test mobile if in scope.
Document whether redirects preserve fragments and query strings—OAuth cares.
Severity negotiation
Bring OAuth/SAML context to triage when redirects touch login—severity debates shorten.
Test whether redirects strip security headers on destination pages.
Recommend allowlists over substring checks—substring fixes break constantly.
Worth reading next
API Hacking: OAuth and SAML Security Notes
CORS, postMessage, and Origin Mistakes in Modern Web Apps
Web Hacking for Pentesters: Server-Side Request Forgery (SSRF)
Comments