3 ms·
Is it ever reasonable to pass a redirect URL directly via the GET parameters? One other concern would be the ease of phishing attacks, e.g. goodsite.com/login?
by d_r 16y ago
Is it ever reasonable to pass a redirect URL directly via the GET parameters? One other concern would be the ease of phishing attacks, e.g.
goodsite.com/login?redirect=http://www.mybadsite.com http://www.mybadsite.com
User logs in to Goodsite, and is redirected to a similar-looking page on Badsite.
One safer alternative would be to store the redirect URL in the session (presuming one is available) and read it back later.
- nbpoole 16y agoYou're talking about what's known as an open redirect. And you're correct: those can definitely be used to make a phishing attack more effective. But as I mentioned, reddit only redirects users to reddit content: you need to provide a relative URL or use a reddit subdomain (eg: http://code.reddit.com http://code.reddit.com) in the dest parameter.