How to Fix an Open Redirect Vulnerability

What makes a redirect endpoint vulnerable

A typical post-login redirect looks like this:

app.get('/redirect', (req, res) => {
  const target = req.query.url;
  res.redirect(target);  // no validation
});

An attacker sends /redirect?url=https://evil.com in a phishing email. The link domain is yours, so spam filters and users trust it - but the browser lands on the attacker's site.

The two-part validation rule

A safe relative path starts with / (e.g. /dashboard) and is not protocol-relative (e.g. //evil.com). Protocol-relative URLs start with // and are treated as external by browsers, so startsWith('/') alone is not enough.

app.get('/redirect', (req, res) => {
  const target = req.query.url;

  // Must start with "/" and must NOT start with "//"
  if (
    typeof target === 'string' &&
    target.startsWith('/') &&
    !target.startsWith('//')
  ) {
    return res.redirect(302, target);
  }

  // Reject - fall back to a safe default
  res.redirect(302, '/');
});

The same pattern applies to vanilla Node.js http without Express:

function isSafeRedirect(target) {
  return (
    typeof target === 'string' &&
    target.startsWith('/') &&
    !target.startsWith('//')
  );
}

// inside your request handler:
const target = url.searchParams.get('url');
const location = isSafeRedirect(target) ? target : '/';
res.writeHead(302, { Location: location });
res.end();

Why blocklisting external URLs does not work

A common but flawed approach is checking whether the URL contains your own domain. Substring matching is easy to bypass:

• https://yourcompany.com.evil.com contains yourcompany.com
• URL encoding and unicode normalization add more bypasses

Allowlisting the shape (relative path only) is the reliable approach. If you genuinely need cross-domain redirects, use a hardcoded allowlist of exact destination URLs validated through a proper URL parser - never string contains or startsWith on the hostname.

Test your fix

# Should redirect to /dashboard (302)
curl -i "http://localhost:3000/redirect?url=/dashboard"

# Should NOT redirect to evil.com - expect redirect to / or a 400
curl -i "http://localhost:3000/redirect?url=https://evil.com"

# Protocol-relative bypass - should also be rejected
curl -i "http://localhost:3000/redirect?url=//evil.com"