Open Redirects: The Vulnerability That Weaponizes Your Domain
When your site sends visitors anywhere
An open redirect is a page that takes a URL as input and forwards the visitor to it — without checking where it points. You've seen the pattern: https://yoursite.com/redirect?url=.... If the destination isn't validated, an attacker can set it to any site they like.
Why it's dangerous
The power of an open redirect is trust. A phishing link that starts with your real, familiar domain is far more convincing than a random URL. Victims (and email filters) see yoursite.com and lower their guard, then get silently forwarded to an attacker's page that harvests credentials or delivers malware.
Open redirects are also used to bypass security controls, launder malicious links, and steal OAuth tokens by redirecting authentication flows.
Where they hide
- Login flows with a "return to" or "next" parameter.
- Marketing and tracking links that forward through your domain.
- Logout handlers that redirect to a supplied URL.
How to check and fix it
- Never redirect to a raw, user‑supplied URL. Validate against an allowlist of known destinations.
- Prefer relative paths, or map identifiers to URLs server‑side instead of accepting full URLs.
- If external redirects are unavoidable, show an interstitial warning page.
Test your redirects
Safeey probes for open‑redirect behavior along with reflected‑input and CORS issues, and reports what it finds. Scan your site.
See what your site exposes
Safeey runs 1,700+ checks and shows you exactly what an attacker would find — with the fixes.
Scan your site