<!DOCTYPE qhelp PUBLIC
  "-//Semmle//qhelp//EN"
  "qhelp.dtd">
<qhelp>


<overview>
<p>Directly incorporating user input into a URL redirect request without validating the input
can facilitate phishing attacks. In these attacks, unsuspecting users can be redirected to a
malicious site that looks very similar to the real site they intend to visit, but which is
controlled by the attacker.</p>

</overview>
<recommendation>

<p>To guard against untrusted URL redirection, it is advisable to avoid putting user input
directly into a redirect URL. Instead, maintain a list of authorized
redirects on the server; then choose from that list based on the user input provided.</p>

</recommendation>
<example>

<p>The following example shows an HTTP request parameter being used directly in a URL redirect
without validating the input, which facilitates phishing attacks.
It also shows how to remedy the problem by validating the user input against a known fixed string.
</p>

<sample src="UrlRedirect.cs" />

</example>
<references>

<li>
OWASP:
<a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">XSS
Unvalidated Redirects and Forwards Cheat Sheet</a>.
</li>
<li>
Microsoft Docs: <a href="https://docs.microsoft.com/en-us/aspnet/mvc/overview/security/preventing-open-redirection-attacks">Preventing Open Redirection Attacks (C#)</a>.
</li>

</references>
</qhelp>
