Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Open Redirect

An open redirect lets an attacker borrow your domain's credibility to bounce victims to phishing pages and steal OAuth tokens. Here is how the unvalidated redirect parameter is abused and how to constrain it.

2 articles 7 min total Overview to advanced techniques

Start with the overview

Open Redirect3 min read

Open Redirect: How Your Trusted Link Sends Users to an Attacker

An open redirect lets an attacker borrow your domain's credibility to bounce victims to phishing pages and steal OAuth tokens. Here is how the unvalidated redirect parameter is abused and how to constrain it.

Read the overview

Open Redirect techniques

1 focused deep-dive
  1. 02 OAuth redirect_uriOAuth redirect_uri Hijacking: Stealing Tokens Through a Loose Redirect 4 min