ASVS 5.0 requirement V3.7.3 says the application must show a notification when the user is being redirected to a URL outside the application's control, with an option to cancel the navigation. It is a Level 3 requirement.
This is the extra layer on top of V3.7.2. The allowlist stops arbitrary destinations, and the warning protects users from approved or user supplied links that still lead somewhere you do not run.
Why it matters
Forums, tickets, chat, comments and profile pages all contain links written by users. Attackers use them for phishing. If your site sends the click straight out, the user assumes your site vouches for the destination. A short interstitial that names the real host breaks that assumption and gives the user a moment to back out.
How to implement it
Route external links through an internal page that shows the destination and asks for confirmation. Never auto forward with a timer for links you do not control.
app.get("/leaving", (req, res) => {
let url;
try { url = new URL(req.query.to); } catch { return res.status(400).send("Invalid link"); }
if (url.protocol !== "https:" && url.protocol !== "http:") return res.status(400).send("Invalid link");
res.render("leaving", { host: url.hostname, href: url.href });
});
In the template, escape both values and show an explicit choice:
<p>You are leaving this site and going to <strong><%= host %></strong>.</p>
<a href="<%= href %>" rel="noopener noreferrer">Continue</a>
<a href="/">Go back</a>
Show the hostname prominently, since the full URL can be long and misleading. Apply the same page to redirects from the server and to links that users post. Links to hosts on your own allowlist of partners can skip the warning if your policy says so.
How to test it
Post a link to an external site in each place users can write: comments, profiles, tickets. Click it and confirm the interstitial appears with the right hostname and a working cancel. Call the redirect endpoint directly with an external target and confirm no Location header is returned without the notice.
Common mistakes
Auto redirect after a countdown. The user has no real chance to cancel.
Showing only a long URL. Show the host.
Unescaped output in the warning page. That creates XSS.
Warning only on some paths. Cover every external redirect.
Quick check
Do links in my own marketing pages need this?
Links you author and review are under your control. The warning is aimed at links that arrive from users or from redirect parameters.
Sources
- OWASP ASVS 5.0, requirement V3.7.3
