Unvalidated Redirects
Unvalidated redirects directly use user input as the redirect destination, exploitable for phishing; synonymous with open redirect.
Purpose
To understand the phishing risk of unvalidated redirect targets and their defenses.
Mechanism
redirect(user_input) does not validate whether the target URL is on a trusted domain, so attackers craft phishing links. Defenses: redirect whitelists, relative paths, interstitial confirmation pages.
Use cases
- Phishing defense
- Redirect security
- URL validation
Related tools
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side. TOOL
HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side. TOOL