Fix an open redirect on your login page

open-redirect-login

Your login page forwards to whatever URL its redirect parameter names, so a phishing link can wear your domain and land on an attacker's page.

Why this matters

Your login page redirects users to any URL via a parameter. This aids phishing by lending your domain's trust to attacker-controlled URLs, but is not direct system exploitation.

Your stack

Next.js

1 Validate the callback URL in your auth handler

typescript

const callbackUrl = searchParams.get('callbackUrl') || '/dashboard';
const url = new URL(callbackUrl, process.env.NEXTAUTH_URL);
// Only redirect to same origin
if (url.origin !== new URL(process.env.NEXTAUTH_URL).origin) {
  redirect('/dashboard');
}
redirect(callbackUrl);

Express

1 Validate the redirect URL against an allowlist of your own domains
2 Never redirect to a user-controlled external URL after login

javascript

function isSafeRedirect(url) {
  try {
    const parsed = new URL(url, 'https://example.com');
    return parsed.hostname === 'example.com';
  } catch {
    return false;
  }
}

app.post('/login', (req, res) => {
  const next = req.query.next || '/dashboard';
  if (!isSafeRedirect(next)) return res.redirect('/dashboard');
  // ... authenticate, then:
  res.redirect(next);
});

Django

1 Use Django's built-in url_has_allowed_host_and_scheme

python

from django.utils.http import url_has_allowed_host_and_scheme

def login_view(request):
    next_url = request.GET.get('next', '/')
    if not url_has_allowed_host_and_scheme(next_url, allowed_hosts={request.get_host()}):
        next_url = '/'
    # ... authenticate, then redirect

Laravel

1 Validate the redirect URL is relative or on your domain

php

// After authentication
$intended = session()->pull('url.intended', '/dashboard');
if (!Str::startsWith($intended, '/') || Str::startsWith($intended, '//')) {
    $intended = '/dashboard';
}
return redirect($intended);

Rails

1 Validate redirect destinations in your sessions controller

ruby

# app/controllers/sessions_controller.rb
def create
  redirect_to = stored_location_for(:user) || root_path
  unless redirect_to.start_with?('/') && !redirect_to.start_with?('//')
    redirect_to = root_path
  end
  redirect_to redirect_to
end

Does your app still have this?

Scan your domain