Open Redirect
Definition
An open redirect is a URL on your site that takes a destination as a parameter and forwards the visitor there unconditionally, for example a path ending in a next or url or returnTo value holding a full external address. Redirects themselves are ordinary: login flows, link trackers and short links all use them. What makes one open is the absence of a check on the target. The redirect can be performed by the server with a 302 status and a Location header, or in the browser with a script that assigns location.href from a query parameter, which is the form a static page is most likely to have. Either way the visitor sees your domain in the link they clicked and somebody else's site when they land.
Why It Matters
The damage is rarely to you directly; it is to everyone who trusts your address. A link that starts with a known hostname passes a glance, passes many email filters and passes the reader's own judgement, then delivers them somewhere else entirely. That is precisely the ingredient a phishing page wants, and hosts treat open redirects on user content as an abuse vector rather than a mere bug. Open redirects also break OAuth-style flows that rely on a redirect target being on a fixed list, and search engines have been known to treat chains of them as spam. The cost of closing one is small: a list of permitted destinations, or refusing anything that is not a relative path.
How It Works
A safe redirect validates before it moves. The strictest rule is to accept only relative paths — a value starting with a single slash and not with two — because a value beginning with two slashes is treated by browsers as protocol-relative and points off-site. Beyond that, parse the target and compare its host against an allowlist rather than checking whether the string merely contains your domain, since a hostname can be crafted to contain any substring. Encoded characters have to be decoded before the check, because a target can be hidden behind percent-encoding. On a static host there is no server-side redirect logic to audit; redirects come either from a 301 redirect rule you configure or from JavaScript in the page itself, and the JavaScript version is where the parameter usually goes unchecked.
Real-World Example
A team publishes a link-tracking page at events-go.99helpers.site that reads a destination from the query string and assigns it to location.href. Anyone can now produce a link on that hostname that lands on a site of their choosing. The fix is to replace the free-form parameter with a lookup: the URL carries a short key, the page maps that key to one of a dozen destinations it knows about, and an unknown key shows a plain message instead of redirecting.
Common Mistakes
- ✕Checking that the target contains your domain name rather than parsing it — a host can be constructed so the check passes and the destination does not
- ✕Allowing a value that begins with two slashes, which browsers read as a protocol-relative URL to another site
- ✕Validating the raw parameter without decoding it first, so percent-encoded characters slip past the check
- ✕Treating an open redirect as harmless because the page holds no data — the harm is to the people who trusted the link
Related Terms
Phishing Page
A web page built to impersonate a real organisation so that visitors hand over credentials or payment details. Hosts treat it as prohibited content and remove it on sight.
Query String
A query string is the part of a URL after the question mark, carrying key-value pairs such as src=newsletter and page=2. It passes small pieces of data along with the request.
URL Anatomy
URL anatomy is the set of parts a web address is built from: scheme, host, path, query string and fragment. Knowing which part is which explains most link problems in seconds.
301 Redirect
A 301 redirect is a response telling the browser that a page has moved permanently and giving the new address. The old URL keeps working for anyone who follows the old link, but everything that matters now lives at the new one.
HTTPS Redirect
A rule that answers any request arriving on plain HTTP with an instruction to fetch the same address over an encrypted connection instead. It makes the secure version the only one visitors actually see.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →