N01 Insecure Redirects

What this means

SiteShadow flagged redirect logic where the destination URL can be influenced by user input (query params like ?next=..., returnUrl=..., redirect=...).

Why it matters

Open redirects can enable phishing, token leakage, or malicious navigation.

• Phishing: your trusted domain becomes a "bounce" to malicious sites.
• Token leakage: OAuth codes/tokens can leak via redirect URLs if flows are misconfigured.
• User trust damage: users learn that links on your site can send them anywhere.

Safer examples

1) Use allowlisted relative paths (recommended)

const next = req.query.next || "/dashboard";
if (!next.startsWith("/")) throw new Error("Invalid redirect");
res.redirect(next);

2) If absolute URLs are needed, allowlist hosts

allowed = {"app.example.com"}
u = urlparse(next_url)
if u.hostname not in allowed:
    raise ValueError("Invalid redirect host")

3) Don't accept redirects from untrusted sources

Avoid reflecting arbitrary URLs back to clients.

How SiteShadow detects it (high level)

• Flags redirect(...) calls using request-derived values.
• Checks for missing allowlists/validation around common redirect parameters.

References

• CWE-601: https://cwe.mitre.org/data/definitions/601.html

---

← Back to Vulnerability Library