Take the 2-minute tour ×  I've been addressing an open-redirect
issue and in experimenting with the latest fix, I noticed that
updating the redirect's protocol to file resulted in a blank
page on the browser.  That is,
redirect.aspx?url=file://legitimate-site.com results in a blank
page. Other protocols like madeup:// get the error page
suggesting there is a generic URL processor that says "these
protocols are okay" and the browser or the proxy is blocking the
malicious redirect.  Obviously, I want the team to limit
redirection to just "http" and "https" but I'm curious as to if
there are any browsers that perform redirects to local files or
if this is a security hole that has been closed for a while. A
quick search has yielded just a few "doesn't work" answers but
nothing official.  share|improve this question add comment  1
Answer  up vote 3 down vote accepted  Generally speaking, no, a
website cannot redirect the browser to a file: URL. This is due
to special restrictions imposed by browsers on use of file