Topic

Open redirect

Web vulnerability class in which an application sends a browser to a destination an attacker controls, usually through a redirect target that is never validated against the application's own origin.

Current clusters

build1 publisher

cas-authentication-user's redirect fix falls back to a request path Node parses as //bad.example.com

The isSafeReturnTo guard added in 0.3.0 refuses //host and /\host correctly. It then falls back to the path the request arrived on, and url.parse reports /\bad.example.com with a pathname of //bad.example.com.

Publishers:dev.to

Reality

Evidence72
Adoption: Insufficient
Hype gap−10
Incentives45
Confidence62