Vulnerability field guide
Open Redirect
An open redirect lets an attacker borrow your domain's credibility to bounce victims to phishing pages and steal OAuth tokens. Here is how the unvalidated redirect parameter is abused and how to constrain it.
2 articles7 min totalOverview to advanced techniques
Start here
returnUrl=https://evil.testStep 01 · Start with the overview
Open Redirect3 min read
Open Redirect: How Your Trusted Link Sends Users to an Attacker
An open redirect lets an attacker borrow your domain's credibility to bounce victims to phishing pages and steal OAuth tokens. Here is how the unvalidated redirect parameter is abused and how to constrain it.
Read the overviewContinue the field guide
1 focused deep-dives