A redirect parameter sends visitors to an external URL
A candidate redirect parameter accepted ShipReady's controlled external destination and returned an off-site redirect response.
Why it matters
Open redirects can make a link on a trusted domain lead elsewhere. They are often used in phishing and can weaken redirect assumptions in authentication flows.
How ShipReady detects it
What it inspects
ShipReady looks only at the site's own crawled, linked, or discovered URLs that already contain a redirect-like parameter with a destination-like value. It excludes sensitive parameters and side-effect paths.
What triggers a finding
For each bounded candidate, ShipReady substitutes a controlled absolute URL and, if needed, a protocol-relative URL. It triggers when a redirect response has a Location value that resolves to the controlled external destination.
What the evidence shows
The affected endpoint responded to a controlled parameter value with an observed off-site redirect. ShipReady does not follow that redirect.
Limits of this check
The rule tests only discovered candidate parameters within its request budget. It does not guess parameter names, probe third-party hosts, replay URLs with sensitive parameters, follow redirects, or establish exploitability in a particular OAuth or SSO configuration. Unanswered probes make coverage incomplete rather than proving a clean result.
How to fix it
Validate destinations with an allowlist
Resolve permitted destinations against a server-side allowlist of local paths or known origins. Reject absolute and protocol-relative destinations unless a specific approved cross-origin flow requires them.
Use server-side state for authentication redirects
For OAuth and SSO flows, bind return destinations to server-side state and validate callback destinations independently of user-controlled query parameters.
How to verify the change
Test rejected destinations
Test the original parameter with controlled absolute and protocol-relative external values, without following the response.
Expected: The endpoint rejects unsafe values or redirects only to an approved local or allowlisted destination.