An open redirect is a page on your site that sends visitors to a destination taken from a URL parameter without checking it. On a store, return URLs after login or payment are the usual cause. Attackers use them to make phishing links look like they belong to your domain.
Definition
OWASP's cheat sheet on unvalidated redirects and forwards says these flaws occur when a web application accepts untrusted input that can cause a redirect to a URL contained in that input. By changing the input to a malicious site, an attacker may launch a phishing scam. Because the server name in the link is identical to the original site, the attempt may look more trustworthy.
Where it shows up on a store
- A login page that redirects to a returnUrl or next parameter after sign in
- A payment return step that sends buyers back to a URL passed in the request
- Tracking links and email click redirectors
- Language or region switchers that redirect to a supplied path
OWASP's example is a login action that, after a successful sign in, returns a redirect to the supplied return URL with no validation. A buyer sees your real domain in the link, signs in, and lands on a lookalike page asking for card details.
How to fix it
OWASP lists these options in order of strength:
- Avoid redirects and forwards where you can.
- Do not accept a full URL as input. Accept a short name or ID that your server maps to a full target.
- If input cannot be avoided, validate it. For local return URLs, use a framework helper that rejects non local destinations.
- If external destinations are needed, allow list approved destinations by comparing the parsed scheme, host and port, and reject userinfo and ambiguous input.
- Optionally route external redirects through a notice page that shows the destination and asks the user to confirm.
The cheat sheet warns against raw prefix or suffix matching of hostnames, because misleading hostnames and userinfo bypass such checks. Use a maintained URL parser instead.
How to test your store
Take any link that carries a destination parameter and change its value to a different domain you control. If the site sends you there, you have an open redirect. Check login, logout, payment return, email links and language switchers. Also review any redirect that happens before authentication.
Forwards matter too
The cheat sheet also covers forwards, where a server routes a request internally based on input. A crafted value can pass an access check and land on a function the user should not reach, so authorize the destination as well.
Quick check
Is an open redirect a serious bug on its own?
It is often rated lower alone, but it lends your trusted domain to phishing and can combine with other flaws. Fix it.
Is blocking the word http enough?
No. Use a parsed host allow list. Simple string checks are easy to bypass.
Sources
Safeguard's code scanning can surface unsafe redirect patterns during review, and you can try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
