Direct answer
An open redirect allows an untrusted input to send users to an unintended destination. Test with an assessor-controlled destination and check the parsed destination, not a string prefix alone.
Find the redirect boundary
Identify login return URLs, sign-out destinations and redirect parameters within the authorized application. Document which destinations are legitimately permitted and obtain a harmless destination controlled by the assessment team.
Reference: OWASP Unvalidated Redirects and Forwards Cheat Sheet.
Compare intended and unapproved destinations
Run the normal flow using an approved local return path, then provide the controlled external destination within the agreed scope. Inspect the Location header or browser navigation and record the final host. Do not send the crafted URL to other people.
- Use a test account and owned destination.
- Record scheme, host, port and path of the result.
- Avoid capturing authorization codes or session tokens.
Evaluate validation
Review whether the application maps fixed destination identifiers or compares parsed components against an allowlist. A domain-looking prefix can be misleading, and URL transformations after validation may change the final destination. OAuth redirect handling has additional protocol-specific requirements.
Verify the correction
Repeat the approved local destination and the unapproved external destination after a fix. Confirm legitimate partner redirects that are explicitly allowed still work, and check error handling without exposing the user's private state.
Assessment limits
An unapproved redirect is not automatically credential theft or account compromise. Establish the observed destination and explain the relevant user workflow and impact separately.
Frequently asked questions
Does a redirect prove phishing occurred?
No. It establishes the application's behavior; phishing impact depends on how the redirect can be used and the surrounding workflow.
Is a string starting with the trusted domain necessarily safe?
No. Parse the final URL and compare the actual host, scheme and port against the approved destinations.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.