Security Test: Open redirection Forgery via Frontend¶

Scanner(s) Support¶

Description¶

Default Severity: high

Open redirection happens when your app blindly trusts a URL provided by the user and sends them to that address without checking it first. This can let attackers trick users into visiting malicious sites that look credible, leading to potential phishing or other exploits. Essentially, if you allow user input to dictate where users go, you're opening up an avenue for someone to redirect them to something harmful. The common mistake is not validating or sanitizing the URL, so it's important to ensure only approved destinations are used.

Configuration¶

Identifier: frontend_request_forgery/open_redirect

Examples¶

All configuration available:

checks:
  frontend_request_forgery/open_redirect:
    skip: false # default

Compliance and Standards¶