Preventing Open Redirection Attacks In C# And JavaScript

There are different types of attacks that exist in web programming, like SQL Injection Attack, Cross Site Scripting Attack(XSS), Open Redirection Attack etc., and we need to take care of these attacks when writing code and trying to keep our applications from these attack.

Today, we will talk about Open Redirection Attack and see the code which prevents it at Server side level as well as client side level.

Web application works on http protocol and redirects to some URL when we click on any link or button. Sometimes, we pass URL in query string and sometimes it passes directly. But this URL can be changed by external users (hackers) and they can tamper with these URLs and redirect users to some malicious URL. This is called Open Redirection Attack.

As per CWE 601

An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.

Therefore, generally we forget to write code to prevent Open Redirection Attack. We just take the URL and redirect to it. However, this is not good way to redirect.

We need to check URL and identify “is this malicious or not?” We need to do these things at code level.

Example of Open Redirection Attack

Let's say, there is a website called “abc.com” which has one login page where users can pass their credentials to the login system. When user passes user name, password, and clicks to log in button, it redirects to some other page where credentials will validate and then it will redirect to welcome page.

However, hackers tampered with the redirect URL of welcome page with some malicious page, which looks and feels the same as abc.com login page and they will show a message that “user name and password are incorrect”. Here generally nobody will care about URL and just retype their valid credentials and click to login. But this time user has entered their credentials with some malicious site and is being hacked.

Server Side Prevention of Open Redirection Attack

So, to prevent this type of scenario we need to write code to check URL which is processing by system, if anything goes wrong it just shows error page or redirects to login page. Generally we do redirection in Asp.Net as follows.

Here, we are only checking Null and Empty URL, we don’t have intention to check if URL is valid or not. To check valid URL, we will validate Request. In the following code, we are validating HttpContext.Current.Request.

We can check if the provided URL is a local URL or not, la ocal URL is that which belongs to the same domain. If URL seems to belong to outside, then it will show error page or redirect to login page.

And before redirecting to URL, we will check and validate. If everything is fine, then we will redirect to provide URL otherwise redirect to login.aspx page. This will prevent your page from being redirected to some other domain which might not be secure or might be tampered with by third party users. So, always be sure before making any redirection. Just check the URL if it exists locally or not.