Fix open redirect vulnerabilities in redirect parameters

30 min Impact: high Effort: medium ✓ Scan-verified — no manual checkbox

If a URL pattern like yoursite.com/redirect?url=anywhere.com sends visitors straight to anywhere.com with no validation, attackers use it to construct phishing links that LOOK like they start on your trusted domain — the visitor sees your domain name right up until the moment they land somewhere malicious.

If a URL like yoursite.com/redirect?url=anywhere.com sends visitors straight to anywhere.com with no validation, attackers use it to make phishing links look like they start on your trusted domain.

How to fix it

1

Find every redirect endpoint your site has

Look for URL patterns handling outbound link tracking, login redirects (?next=, ?returnTo=), or affiliate link cloaking.
2

Validate the destination against an allowlist

Before redirecting, check the target URL against a list of your own known-safe paths or domains — reject anything not on the list.
3

For login/auth redirects, restrict to relative paths

A post-login "return to where you were" redirect should only ever accept a path on your own site (like /account), never a full external URL.
4

Test with an external URL to confirm the fix

Try your redirect endpoint with a parameter pointing to a domain you control that you can verify — confirm it's rejected or ignored, not honored.

Common mistakes

This is often built early in development for legitimate tracking purposes and never revisited with security in mind — worth checking even on features that seem harmless.

How you'll know it's done

No redirect endpoint on your site will send a visitor to an arbitrary external URL without validation against a known-safe allowlist.

H.I.V.E. checks this automatically

Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.

Run this check in H.I.V.E. →

Fix open redirect vulnerabilities in redirect parameters

How to fix it

Common mistakes

How you'll know it's done

Related checks

H.I.V.E. checks this automatically