URL Redirection to Untrusted Site ('Open Redirect')

  package main
  
- import "net/http"
- 
- func handler(w http.ResponseWriter, r *http.Request) {
-     target := r.URL.Query().Get("redirect")
-     // Vulnerable: redirect to user-controlled URL
+ import (
+     "net/http"
+     "net/url"
+ )
+ 
+ var allowedHosts = map[string]bool{
+     "example.com":     true,
+     "app.example.com": true,
+ }
+ 
+ func handler(w http.ResponseWriter, r *http.Request) {
+     target := r.URL.Query().Get("redirect")
+     u, err := url.Parse(target)
+     if err != nil || (u.Host != "" && !allowedHosts[u.Host]) {
+         http.Error(w, "Invalid redirect URL", http.StatusBadRequest)
+         return
+     }
+     // Safe: only allows relative paths or allowed domains
      http.Redirect(w, r, target, http.StatusFound)
  }
  

- export function middleware(request) {
-   const redirectUrl = request.nextUrl.searchParams.get('redirect');
-   if (redirectUrl) {
-     return NextResponse.redirect(redirectUrl);
-   }
+ const ALLOWED_PATHS = ['/login', '/dashboard', '/profile'];
+ 
+ export function middleware(request) {
+   const redirect = request.nextUrl.searchParams.get('redirect');
+   if (redirect && ALLOWED_PATHS.includes(redirect)) {
+     return NextResponse.redirect(new URL(redirect, request.url));
+   }
+   return NextResponse.redirect(new URL('/', request.url));
  }
  

  const express = require('express');
  const app = express();
  
- app.get('/redirect', (req, res) => {
-   const url = req.query.url;
-   res.redirect(url);
+ const ALLOWED_REDIRECTS = ['/home', '/dashboard', '/profile'];
+ 
+ app.get('/redirect', (req, res) => {
+   const url = req.query.url;
+   if (ALLOWED_REDIRECTS.includes(url) || url.startsWith('/')) {
+     res.redirect(url);
+   } else {
+     res.redirect('/home');
+   }
  });
  

  from flask import request, redirect
- 
- @app.route('/goto')
- def goto():
-     url = request.args.get('url')
+ from urllib.parse import urlparse
+ 
+ ALLOWED_DOMAINS = {"myapp.com", "www.myapp.com"}
+ 
+ @app.route('/goto')
+ def goto():
+     url = request.args.get('url', '/')
+     parsed = urlparse(url)
+     if parsed.netloc and parsed.netloc not in ALLOWED_DOMAINS:
+         url = '/'
      return redirect(url)