Forward and Redirect Cheat Sheet

Revision as of 15:09, 12 March 2013 by Jmanico (Talk | contribs)

Jump to: navigation, search


The Forward and Redirect Cheat Sheet is a technical guide that explains how URL Forward and Redirects attacks works . Forward and redirect attacks are possible when a web page accepts a redirection parameter (a url ) in a query-string. When using an URL as input string to a request being initiated from a browser, it is important to validate the URL. It is essential to determine that the redirect or forward is appropriate based on the request and the user is authorized to access the target.

The biggest risk of allowing a URL as input without validating it, may result in Phishing scams where users are redirected to malicious websites , which collects the users authentication session or steals the username and password.

Programming URL redirects


 /* Redirect browser */



In these above examples , the URL is being explicitly declared in the code. Suppose you want to use this URL as a query string to allow a more dynamic way of programming, such as building a URL list or saving these URL's in the database. In that case, the URL's string instead of being hard coded, it's changed by a variable . The variable is a data type string which is later used in the code.

Redirect Example



 $redirect_url = $_GET['url'];
 header("Location: " . $redirect_url);

A similar example of C# .NET Vulnerable Code:

 string url = request.QueryString["url"];



Example 2



Listing 1 – ASP.NET MVC 2 LogOn action in AccountController.cs

 public ActionResult LogOn(LogOnModel model, string returnUrl)
   if (ModelState.IsValid)
       if (MembershipService.ValidateUser(model.UserName, model.Password))
           FormsService.SignIn(model.UserName, model.RememberMe);
           if (!String.IsNullOrEmpty(returnUrl))
               return Redirect(returnUrl);
               return RedirectToAction("Index", "Home");

   return View(model);

Forward Example



  public class RedirectServlet extends HttpServlet {
     String query = request.getQueryString();
     if (query.contains("url")) {
      String url = request.getParameter("url");

Attack Vectors and Risk




Security Weakness


Technical impacts


Business impacts

Consider the business value of retaining your users’ trust

  • What if they get owned by malware?
  • What if attackers can access internal only functions?
  • Am I Vulnerable To Unvalidated Redirects and Forwards?





How Do I Prevent Unvalidated Redirects and Forwards?


  • Simply avoid using redirects and forwards.


Example validation in .NET:

 protected btRedirect_Click( object sender, EventArgs e )
  if ( this.IsValid )
    Response.Redirect( ... );
  • Sanitize input by creating a list of trusted URL's.


  1. OWASP Article on Open Redirects

External Links

  1. CWE Entry 601 on Open Redirects
  2. WASC Article on URL Redirector Abuse
  3. Google blog article on the dangers of open redirects
  4. Preventing Open Redirection Attacks (C#)

Other Cheatsheets

OWASP Cheat Sheets Project Homepage

Developer Cheat Sheets (Builder)

Assessment Cheat Sheets (Breaker)

Mobile Cheat Sheets

OpSec Cheat Sheets (Defender)

Draft Cheat Sheets