Security Test: Open redirection Forgery¶

Description¶

Default Severity: high

Open redirection happens when an application uses user input to decide where to send users without properly checking that input. This lets an attacker trick the app into sending users to a malicious website that looks like the legitimate one, which can help launch phishing attacks. Developers need to watch out for simple mistakes like not validating or sanitizing URL parameters, which can let attackers exploit the trust users have in the verified domain. Left unchecked, this vulnerability can erode user trust and expose them to various types of online attacks.

Configuration¶

Identifier: request_forgery/open_redirect

Examples¶

All configuration available:

checks:
  request_forgery/open_redirect:
    skip: false # default

Compliance and Standards¶