3 ms·
This is why redirect links should limit themselves to relative URLs, or limit it to a whitelisted set of domains. (Can anyone think of downsides to limiting yo
by chacha102 17y ago
This is why redirect links should limit themselves to relative URLs, or limit it to a whitelisted set of domains.
(Can anyone think of downsides to limiting yourself to relative URLs or a whitelist of domains?)
It is very interesting that Youtube has this vulnerability. Almost every time I implement something like this, I double check the domain name. (This is really easy in PHP)
- sparkiegeek 17y agoThe redirect I found on https://www.google.com https://www.google.com seems like it did have a whitelist. Luckily youtube.com was on the whitelist, so I could re-use the exploit from there. So even whitelists aren't totally safe (and YouTube isn't using the redirect for known friendly sites - seems to be more for tracking purposes). http://news.ycombinator.com/item?id=1259844 http://news.ycombinator.com/item?id=1259844 for the google.com URL