Open redirect is a vulnerability that sounds minor compared to a database leak or a stolen key, and it's genuinely lower stakes in most cases. It's still worth understanding, because it's common in fast-built apps and its actual impact, borrowing your domain's trust for someone else's phishing page, is more concrete than the name suggests.
Where this feature usually comes from
A common, genuinely useful pattern: after logging in, or after completing some action, redirect the user back to wherever they were trying to go before, often passed along as a URL in the request itself. Convenient, and it works well when the destination is always somewhere on your own site. The vulnerability shows up when that destination parameter isn't checked, and can point to any URL at all, not just pages on your own domain.
What that actually enables
If your app will redirect to any URL supplied in a parameter, someone can construct a link that starts with your real, trusted domain, something a visitor recognizes and clicks without suspicion, that then immediately forwards them to a completely different site, one designed to look like a login page and steal whatever credentials get typed into it. The visitor sees your familiar domain in the link they clicked, has no easy way to notice the redirect happening, and lands somewhere convincingly designed to harvest their information, all while the link itself technically pointed at your legitimate site first.
Why this is worse than it might sound
This turns your own domain's reputation and trust into a tool against your own users. Email spam filters and security-conscious users are trained to check whether a link's domain looks legitimate. A link starting with your real, trusted domain passes that check, even though it ultimately lands somewhere entirely different. It's specifically valuable to a phisher precisely because it borrows credibility your app has already earned.
How to actually check your own app
- Look for any feature that redirects based on a URL passed in as a parameter: a login redirect, a "return to previous page" feature, a logout destination.
- Try passing a full external URL, a site you control or a harmless test page, as that parameter, and see whether your app actually redirects there.
- If it does, that's the gap. If it only redirects to a path on your own domain regardless of what's passed in, it's handled correctly.
The fix
Validate that any redirect destination is actually a path on your own domain, an internal, relative path rather than a full external URL, before redirecting anywhere. If you genuinely need to redirect to external destinations for some legitimate feature, maintain an explicit list of approved destinations rather than accepting anything passed in. It's a small, mechanical fix once you know to look for it, closing off a real, if quieter, way your own trusted domain can end up working against your own users.