Actions
Task #7805
openRestrict allowed redirect URLs to specific addresses
Start date:
11/27/2024
Due date:
% Done:
0%
Estimated time:
To be discussed:
No
Description
Enhance the redirection logic to allow only explicitly whitelisted URLs or characters, providing a more robust defense against open redirection vulnerabilities.
A previous issue addressed an open redirection vulnerability by disallowing root redirects ("/") and limiting redirects to relative paths. However, there is room to improve security further by explicitly restricting the allowed redirect destinations.
Proposed Solution:
Implement a whitelist-based approach that validates redirect URLs against a predefined set of allowed destinations or characters. This will minimize the risk of vulnerabilities caused by incorrect parsing or unexpected input formats.
Related issues
Actions