open-redirect
Safeguard articles tagged "open-redirect" — guides, analysis, and best practices for software supply chain and application security.
8 articles
Safely Parsing Untrusted URLs in Node.js
Node's legacy url.parse() is deprecated (DEP0169), and parser mismatches between it, the WHATWG URL API, and fetchers are a documented root cause of SSRF and open redirects.
Robust URL Validation in Python: Stopping SSRF and Open Redirects
One misparsed IP string cost Capital One 106 million records. Here's how to validate URLs in Python without repeating that mistake.
Open Redirect Vulnerabilities: Prevention Guide
An open redirect lets an attacker use your trusted domain to send victims anywhere — the ideal setup for phishing and OAuth token theft. Here's how to build redirects that can't be abused.
Preventing open redirect vulnerabilities in Laravel
Laravel's own ->away() helper is documented as a bypass of its URL safety checks — feed it user input and you've built an open redirect, CWE-601, into the framework's happy path.
CVE-2018-14574: Open redirect in Django CommonMiddleware
CVE-2018-14574 let attackers abuse Django CommonMiddleware's APPEND_SLASH redirect to send users to external, attacker-controlled domains.
CVE-2023-41080: Apache Tomcat Open Redirect in FORM Authentication
CVE-2023-41080 lets a crafted URL trigger an open redirect during FORM login on Tomcat's ROOT web app. Here is the exact condition, affected versions, and the one-line fix path.
Open Redirect Vulnerabilities: What They Are and How to Fix Them
An open redirect vulnerability fix is usually a ten-line change, but the bug keeps shipping because redirects hide in login flows, tracking links, and OAuth callbacks. Here is how to find and close them.
Express.js open redirect vulnerability (CVE-2024-29041)
CVE-2024-29041 lets attackers weaponize Express.js redirects for phishing. See affected versions, CVSS/EPSS data, and how to remediate fast.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.