REFERENCE GUIDE
Open redirects and destination-policy consequences
An open redirect sends a client to an attacker-chosen destination through a trusted application URL.
Also known as: unvalidated redirect
Mechanism
An open redirect sends a client to an attacker-chosen destination through a trusted application URL. The primitive is navigation control, with impact depending on surrounding workflows such as authentication callbacks, trusted-link checks, or sensitive query parameters. Parser disagreement can arise between a validation layer and the browser interpreting the Location value.
Practical method
Capture the redirect response without automatically following it. Compare relative paths, absolute URLs, scheme-relative forms, and encoded separators in the local fixture. Determine whether the final destination is constrained after decoding. Inspect which parameters survive into the destination URL.
curl -i --max-redirs 0 "https://lab.example/continue?next=/account"Interpreting evidence
Confirm the browser destination and the server Location header together. An application rendering a link is different from automatically redirecting, and a harmless external redirect is not a full account-compromise chain.
Pitfalls and limits
Allowlisting a string prefix can accept unintended authorities. OAuth redirect implications depend on exact provider checks. Server-side fetch redirects belong to SSRF and require a different evidence model.