On this page
What Is an Open Redirect (and Why Do Phishers Love It)?
An open redirect lets a site send visitors to an attacker-chosen URL. Learn how it's abused for phishing and how to close it with one validation.
Quick answer
- An open redirect is an endpoint that forwards visitors to a URL the attacker controls.
- It’s a phishing enabler: the link looks like your site, so users trust the destination.
- The fix is to redirect only to allowlisted URLs — same origin or a configured list — never to arbitrary input.
What is an open redirect?
It’s an endpoint that takes a destination from the request and sends the browser there: /redirect?url=https://evil.com sends visitors to evil.com. The vulnerability is that the destination isn’t validated. They appear in login flows, link shorteners, and ‘you’ve been logged out, continue here’ pages. By itself an open redirect does nothing harmful — but as a building block it makes phishing nearly undetectable, which is why security scanners flag it.
Why do attackers care about a redirect?
Because the redirect URL lives on your trusted domain. A phishing email saying ‘your session expired — log in again’ with a link to yoursite.com/redirect?url=https://evil.example looks legitimate: the domain is right, and only after the redirect does the user land on the fake login. Tools that block known-malicious domains don’t catch it because the link is to your site. The attacker converts your reputation into trust for their page.
How do I fix an open redirect?
Never redirect to arbitrary input. Validate the destination: allow only relative paths on your own site, or a fixed allowlist of external URLs. Check for the classic bypasses too — schemes like //evil.com (protocol-relative), backslashes, and encoded characters. Most web frameworks have safe helpers for this, but the AI-generated version usually does a naive substring check that attackers walk around.
# Safe: only allow same-site relative destinations\nfrom urllib.parse import urlparse\n\ndef safe_redirect(dest: str) -> str:\n parsed = urlparse(dest)\n if parsed.scheme == "" and parsed.netloc == "":\n return dest # relative path, same origin\n raise ValueError("external redirect not allowed")Where this bites vibecoders
AI assistants generate ‘continue after login’ redirects with the first thing that works: echo back the next parameter. The naive version is an open redirect, and the assistant’s own fix attempt is often a broken substring check (‘if evil.com not in url’) that fails against //evil.com or encoded variants. This is a good example of the review loop: the vulnerability is invisible in normal use and only shows up under adversarial input.
Where AI coding assistants get this wrong
- Redirecting to any URL passed in a query parameter without validation.
- Substring allowlist checks that miss //host, backslashes, and URL-encoded bypasses.
- Validating the redirect target after following it, or validating the wrong string.
- Treating open redirects as cosmetic because they need user interaction to be dangerous.
Checklist
- Redirect only to relative paths or an explicit allowlist of external URLs.
- Validate with a URL parser, not string matching.
- Test the bypass patterns: //evil.com, backslashes, encoded characters.
- Remove unused redirect endpoints entirely when possible.
FAQ
Is an open redirect a serious vulnerability?
On its own it’s usually rated low, because it needs a user to click. In practice it’s a multiplier: paired with phishing, it turns your trusted domain into cover for credential theft. Bug bounty programs routinely pay for them because of this abuse chain.
What should my login redirect actually do?
Redirect to a relative path on your own site (like /dashboard), or to a destination you stored in the session server-side during login initiation. Never take the destination from the URL and follow it blindly.
Related topics
- What Is Phishing-Resistant MFA?
- What Is CSRF (Cross-Site Request Forgery)?
- What Is a Man-in-the-Middle Attack?
- What Are Security Headers (and How Do You Add Them)?
- What Is Dependency Confusion (and How Do You Prevent It)?