Open Redirects – Ups and Downs


A few years ago, when FogMarks was not even a tiny idea or a vision in my head, I used to do casual programming jobs on Fiverr.

One of the jobs/gigs(?) I was asked to do is to cause a user in site x.com to be redirected to Facebook.com and then, without an action from his side, to be redirected to a y.com site. I didn’t realize back then why would someone want the kind of thing. Why not simple redirecting the user directly to y.com?
I asked the person why would he want to do such a thing. His answer changed the way I (and after that, FogMarks,) treated and took care of Open Redirects.  He answered that by forcing a user come from a Facebook URL, the ads engines on y.com are paying much, much more, because a popular site like Facebook is redirecting users to y.com.

Until this answer I treated open redirects as simple security issues, that can’t hurt that much. I know that innocent user can get a link of the type: innocent.com?redirect_out=bad.com, but I believed that anyone with a little common sense will see such things going on. Those kind of attacks are mostly being used by Phishing web sites, to try and simulate the domain of innocent.com.

After this long introduction, I want to introduce today’s topic – the solution to open redirects. Facebook did it in their Linkshim system, but I want to introduce a much simpler solution that any of you can use.

Quick Note: Who should not adopt this solution? Websites who want their domain to be present on the Referrer header.

Well, the regular ways I have seen to prevent open redirects are creating a token (YouTube, Facebook’s l.php page), forbidding URLs that don’t not contain the host of the website and allowing a user to be redirected only from a POST request.

While creating an exit token is a good practice, handling and taking care of this whole system is pretty much of a headache. You have more values to store at the DB, you should check for expiration times, IP address and a lot more.

Forbidding URLs that don’t not contain the host of the website is simply wrong. Websites should allow other users to be redirected to another websites, not only pages within themselves.

And allowing user to be redirected only after he clicks on a button, for example, isn’t always that convenient – to you or to the user.

The Golden Solution
Honestly, the first thing you’ll about to say is: “What? This guys is crazy”. But the next thing will be: “Okay, I should give that a try”.
Well, a lot of websites today offers a free URL shortening services. In addition to that – they offer a free modular & convenient API.
Why don’t use them?!

Instead of carefully creating an exit token, forbidding outside redirects or requiring POST, simply translate any outside URL to a shortened URL that a certain service provides. If you don’t want third party services to store your information, you build one of your’e own using an open source system.

That way – you won’t have to worry about open redirects – they won’t be occur from your domain.

Lets say you have a page called ‘redirect_out.php’ with an r GET parameter that a user can supply:

my.com/redirect_out.php?r=http://bad.com

Accept the bad.com URL from the user, automatically translate it to a shorte.nd/XxXxX URL and then allow redirection.

Extra: Benefits of using a well known shortening service
As mentioned before, this solution is offered only to developer who don’t want their domain to be shown up as the referrer. If your worried about phising attacks, its a different scenario. Although by using a well known shortening service which manages a black list of known “bad domains” you’ll earn twice:

  • Your’e domain will not be the one who redirected users to ‘bad’ websites (yes, Google knows and checks that too)
  • You’ll increase the phishing protection level of your web. Your users will be able to be redirected to ‘bad’ web sites, but the shortening service will deny it, or at least warn those users (and potentially you).

 

3,867 thoughts on “Open Redirects – Ups and Downs

  1. You coᥙld definitely seе уour enthusiasm ԝithin the article
    you write. Thhe arena hopes for even more passionate writers such as you
    who aren’t аfraid to mention how tһeү beliеve. All the time go
    after your heаrt.

    • Do you mind if I quote a few of your articles as long as I provide credit
      and sources back to your site? My blog site is in the exact same area of
      interest as yours and my users would certainly benefit from a
      lot of the information you provide here. Please let me know if this alright with you.
      Regards!

  2. “I notion dad most likely was considered true upabout the size of it’s avid gamers, He admits that. “But nonetheless, i additionally considered that he might well have modified on discovering the right whole creating agreeable. He was even alot further separated only available on top of snowboarding acquired your partner’s motor coaches, This has been her golf grinders hence concerned it.

  3. In addition, the FHA insures purchase-and-improvement loans for when you want to get a home that needs repair works; 203k building lendings for when you want to
    acquire a house that’s newly built; as well as energy-efficiency loans
    for when you want to fund the prices of energy-efficiency renovations into
    your financing.

  4. Having actually filed for backruptcy myself, I understand that
    you have to wait a minimum of 2 years after your discharge date
    to get approved for an FHA financing.

  5. FHA intends to make sure that 41 % to 43 % of your
    monthly gross income can be put on making the minimal settlements on all your month-to-month financial obligations, including revolving
    charges as well as installment lendings, stated
    Scott Smith, head of state of, a Salt Lake City-based credit history repair work business.

  6. First and foremost, the condo structure must be accepted by FHA (FHA accepted apartment checklist ).

    This just means that certain papers have actually been finished and also authorized off by FHA.

  7. With a conventional mortgage loan, vendors could just
    add approximately $3,000 towards the purchaser’s closing costs, however
    with an FHA mortgage, sellers could contribute
    approximately $6,000.

  8. The FHA reduced the waiting duration to one
    year if you could reveal you went through a foreclosure, short sale, personal bankruptcy, or action instead of foreclosure because of an external financial event, like a loss of revenue or work (or a
    combination of both) with no mistake of your very own.

  9. Part 251 insures home purchase or refinancing lendings with interest
    rates that might enhance or reduce over time, which allows consumers to buy or re-finance their house at a reduced initial interest rate.

      • Hi there! I know this is kinda off topic but I was wondering which blog platform are you using
        for this website? I’m getting sick and tired of WordPress because I’ve had problems with hackers and I’m looking at alternatives
        for another platform. I would be great if you could point me in the direction of a good
        platform.

      • In the event you like I can construct a website for you
        free of cost and level your area to it. You may
        log in and add no matter you wish to add to it to make your
        site come alive.

      • Do you mind if I quote a few of your posts as long as I provide
        credit and sources back to your blog? My blog site is in the very same area
        of interest as yours and my users would truly benefit from some of the information you present here.
        Please let me know if this ok with you. Many thanks!

    • I’m impressed, I must say. Rarely do I come across a blog that’s equally educative and engaging, and let me tell you, you’ve hit the
      nail on the head. The problem is something not enough folks are speaking intelligently
      about. I am very happy I found this during my search for something
      regarding this.

    • I’m not sure why but this weblog is loading very slow for me.
      Is anyone else having this problem or is it a issue on my end?
      I’ll check back later on and see if the problem still
      exists.

    • In case your web host is encountering major issues and you can not have entry to your knowledge,
      you will be able to switch to another host by merely importing your website to a special server.

    • With havin so much content do you ever run into any problems of plagorism or copyright
      violation? My website has a lot of exclusive content I’ve either written myself or outsourced but
      it seems a lot of it is popping it up all over the web without my agreement.
      Do you know any methods to help prevent content from being stolen? I’d certainly appreciate it.

    • Great work! That is the type of info that should be shared
      around the net. Disgrace on the seek engines for now not positioning this put up higher!
      Come on over and discuss with my site . Thank
      you =)

  10. The FHA will insure single-family removed residences, 2-unit
    residences, 3-unit residences, 4-unit residences,
    condos, mobile houses and also produced homes.

    • Right here is the right webpage for anybody who would like
      to find out about this topic. You know so much
      its almost hard to argue with you (not that I really
      will need to…HaHa). You certainly put a brand new
      spin on a subject that has been written about for decades.
      Great stuff, just wonderful!

  11. The program stemmed during the Great Depression of the 1930s, when the
    rates of repossessions and also defaults increased
    sharply, and the program was planned to give lending institutions
    with sufficient insurance Some FHA programs were subsidized by the federal government, but the
    objective was making it self-supporting, based upon insurance coverage premiums paid by borrowers.

    • hello there and thank you for your information – I’ve definitely picked up
      something new from right here. I did however
      expertise some technical points using this site, as I experienced to
      reload the web site many times previous to I could get it to load properly.
      I had been wondering if your hosting is OK? Not that I am complaining, but slow loading instances times will often affect your placement in google and could damage your quality
      score if advertising and marketing with Adwords. Well I’m
      adding this RSS to my email and can look out for a lot more of your respective fascinating content.
      Ensure that you update this again soon.

  12. The FHA loan program was at first created in the 1930s as a way to help the housing market get on it’s feet as well
    as since it’s launch it has helped millions of households get into a home that would certainly have or else not gotten approved for standard funding.

  13. When you answer this concern, your objectives should be: 1) Display your personality and also let the recruiter learn more
    about you much better; 2) Walk through your life decisions/accomplishments as well as exactly how
    it has formed you; and 3) Encourage your recruiter that you are genuinely interested in financial
    investment financial and also you have the abilities needed to be an effective expert.

  14. Over time, exclusive home loan insurance policy (PMI) firms came into play,
    as well as currently FHA mostly offers people who could not afford
    a traditional down payment or otherwise do not get approved for PMI.

  15. He ended up being able to acquire a 15-year home
    loan at 3.65 % for his initial residence from Churchill Home mortgage, which
    provides a no rating lending product by taking non-traditional lines of credit and also including them to Pittman’s credit rating.

  16. The program originated during the Great Depression of the
    1930s, when the rates of repossessions and defaults
    rose greatly, and the program was intended to provide lenders with adequate insurance policy Some FHA
    programs were supported by the government, yet the objective was
    to make it self-supporting, based on insurance policy costs paid by
    customers.

  17. The benefit of a fixed-rate mortgage is that your
    rate of interest stays the very same throughout the lending period, so you recognize
    specifically just how much your regular monthly settlement will certainly be.

  18. The FHA lowered the waiting period to one year if
    you could show you looked at a foreclosure, short sale, insolvency, or
    action in lieu of repossession because of an exterior
    economic event, like a loss of income or employment (or
    a mix of both) with no fault of your very own.

  19. In order for a financial institution to obtain the FHA’s insurance on its financings, it was required to verify that its loans fulfilled
    the FHA’s minimal certification criteria.

      • There isn’t really any type of need to fear over substandard top quality and there’s no reason to have a locksmith that is unqualified to do any work, which will ultimately should be redone.

      • Since a business will certainly bill you more if it needs to travel farther, do a search
        for one that’s close to your residence so the company people could reach you earlier and bill
        you much less.

      • Our auto locksmith professional specialists have actually been striving to transform into the masters in automobile key reducing innovations
        when you have actually lost or lost your tricks don’t fret with one contact
        us to American Finest Locksmith we will have one of our extremely experienced expert automobile locksmith professional on their way right to
        your area to reduce and also program tricks for what ever kind of automobile,
        motorcycle, van or truck you own.

      • If you take place to be situated in or around Cornwall and
        also are required to handle vehicle relevant loc and key issues, Car Locksmith professional Cornwall are well geared up to deal with a variety of troubles.

  20. According to the Home mortgage Understanding Center, conventional home loan lending institutions look for an excellent credit score no less compared to 680.

  21. She began finding results after a week; she reported that her sugar cravings were fell, she’d more energy, and she went down a
    dress size from 10 to 8. She’d no side effects.

  22. FHA loans can additionally be assumable, which indicates in the
    future it would be possible for somebody to presume an FHA
    financing from the initial borrower.

    • I think what you wrote made a bunch of sense.
      However, what about this? suppose you added a little information? I am not suggesting your content is not
      solid., however what if you added a title that makes people desire
      more? I mean Open Redirects – Ups and Downs | FogMarks is kinda
      boring. You might peek at Yahoo’s front page and see how they create article titles to get viewers interested.

      You might try adding a video or a picture or two to
      grab people interested about everything’ve got to say. Just my
      opinion, it would make your posts a little bit more interesting.

    • Hello There. I discovered your weblog the usage of msn. This is a very neatly written article.
      I’ll make sure to bookmark it and return to learn more of your helpful
      information. Thank you for the post. I’ll definitely return.

  23. Very often find 50 a number of weekly along farm inside Kentucky, I purchased this breadmaker a majority of these betterscooter.com http://www.scamadviser.com/check-website/betterscooter.com from your slip and also used the him or her throughout rainfall, sleet, compacted snow, magnetic, together with anything different you may perhaps find with the professions. They organized Very good combined with seemed to be sweet the whole of the precious time, options That i experienced could be that the locks located on the villain wore at a distance promptly (caused by plummeting that company on / off), and the rainproof synthetic leather started to drip just a bit of, which might be sorted out due to set protectant. I i am satisfied to experience documented many [$], because Groundbreaking, i was tell you that a few hard cold weather was considered much more welcoming given that a good arches remained at appropriately manner.

    • My spouse and I stumbled over here by a different website and thought I might check things out.
      I like what I see so now i’m following you. Look
      forward to going over your web page repeatedly.

    • I used to be suggested this website through my cousin. I’m not certain whether this
      put up is written by means of him as nobody else know such certain approximately my
      difficulty. You are amazing! Thanks!

  24. Excellent post. I used to be checking constantly this blog
    and I’m impressed! Very helpful information specifically
    the last part 🙂 I deal with such information a lot.

    I used to be seeking this certain info for a very long time.
    Thanks and best of luck.

    • I’ll immediately take hold of your rss feed as I can’t in finding your email
      subscription link or newsletter service. Do you’ve any?
      Please permit me understand so that I may subscribe.
      Thanks.

  25. you are actually a just right webmaster. The site loading pace is amazing.
    It seems that you are doing any unique trick.
    Also, The contents are masterwork. you’ve performed a fantastic activity in this
    topic!

  26. Its like you read my mind! You appear to know a
    lot about this, like you wrote the book in it or something.
    I think that you can do with a few pics to drive the message home a bit, but instead of that, this is excellent blog.

    A great read. I will definitely be back.

  27. Hi! I could have sworn I’ve been to this site
    before but after checking through some of the post I realized it’s new to me.
    Nonetheless, I’m definitely glad I found it and I’ll be book-marking
    and checking back often!

  28. It’s really a nice and helpful piece of info. I am
    satisfied that you shared this helpful information with us.

    Please keep us informed like this. Thanks for sharing.

    • I’m really enjoying the theme/design of your website.
      Do you ever run into any browser compatibility issues?
      A number of my blog audience have complained about my
      website not working correctly in Explorer but looks great in Opera.
      Do you have any advice to help fix this issue?

    • It’s a pity you don’t have a donate button! I’d most certainly donate to
      this fantastic blog! I suppose for now i’ll settle
      for bookmarking and adding your RSS feed to my Google account.

      I look forward to fresh updates and will share this website with my Facebook group.
      Talk soon!

    • It could additionally be as complex as requiring an individual’s pre-coded biometrics, such as a finger print, to turn on the lock (either
      for securing or unlocking).

    • Houston, 1st Selection Locksmith professional is Proud to service Greater
      Houston, Katy, Sugarland, Stafford, Rosenberg, Richmond, Levels,
      Jersey Town, Memorial, Bunker Hill, Meadows, River Oaks, Royal oaks,
      Alief, Cypress, Springtime and also surrounding regions.

    • Get in touch with us today at -LRB-206-RRB- 274-7061 to find out more
      about our amazing Seattle vehicle locksmith professional solutions,
      set up a consultation, or request emergency solution.

    • Automobile Locksmith professional company in Sylmar
      has actually reached a significant development as well as has actually
      kept its operation as it caters to a lot more car owners.

    • Our car locksmith company continuouslies grow due to
      our attention to information, quick action times as well as superb worth for cash, our vans are stocked with all the most up
      to date equipment and also we carry a large number of
      remotes and car crucial blanks permitting us to accomplish
      most jobs at the roadside.

    • We are frequently educating our auto locksmiths on one of
      the most as much as date techiques and treatments in order to rapidly as well as successfully
      repair, change and set up any type of component you might require.

    • What i don’t understood is if truth be told how you’re now not actually
      much more smartly-appreciated than you might be now.
      You’re so intelligent. You already know thus considerably
      in the case of this topic, made me individually believe it from so many various angles.
      Its like women and men aren’t interested except it’s one thing to accomplish with Girl gaga!
      Your own stuffs outstanding. All the time maintain it up!

    • As an illustration, if you buy an iPod from the site utilizing coupon codes, you can have it engraved with their name and even add their favorite music earlier than you
      reward it to them.

    • If it takes over a week for the web host to respond to
      your request, and if your web site goes offline in the meantime,
      this might have lasting unfavourable penalties.

  29. See our Do-It-Yourself Septic Evaluation Video Doing your own evaluation in between pumpings could assist you save money and maintain your septic tank working correctly.

    • As expert locksmiths we will certainly open your door by lock selecting
      or drilling the lock, keeping any type of potentially expensive damage to
      the surrounding door to a minimum.

    • This web site internet hosting assistance provider
      is created for every the starter and the revolutionary
      webmaster as in case you have no idea a lot about web sites
      then you possibly can even now management to make a website using the attribute prosperous website
      builder that Hostgator supply to you as a member.

    • Locksmith professional Journal International, a profession magazine for the
      occupation, informally surveys its viewers every
      couple of years to establish a nationwide standard.

    • There is also an essential making company as well as you can be supplied with solutions associated with your protection or emergency situation locksmith professional needs anywhere in or around Arlington, TX.
      There is a 24 Hr locksmith professional team of
      specialized technicians that we work with that have actually
      completed extensive locksmith training and have actually all been subject to security look for
      your safety and safety and security.

    • Furthermore, we will match the ignition cylinder lock
      with your initial trick, this way you will have one key for your ignition as
      well as your car locks (avoiding the expense of
      reprogramming keys) as well as on the occasion that you shed
      your trick, we can make you a key off your VIN without changing your
      ignition cyndrical tube lock.

    • When you engage a general contractor to work on your project,
      make certain that you locate one that agrees to a fixed price contract.
      Every homeowner has an interest in home improvement. While carpet may have been very
      popular a decade ago, now apart from bedrooms, it is no
      longer in vogue.

    • I am really inspired with your writing talents and also with the layout to
      your weblog. Is this a paid subject or did you modify
      it yourself? Anyway stay up the nice high quality writing, it’s rare to peer a nice blog like this one today..

    • Since the company was founded in 1978, it has experienced incredible growth,
      do at least in part to competitive pricing and quality merchandise.
      Basically, it is relatively easy to upgrade the surrounding area of the fireplace,
      aside from the mantle. While carpet may have been very popular
      a decade ago, now apart from bedrooms, it
      is no longer in vogue.

    • Hello! This is kind of off topic but I need some guidance from an established blog.
      Is it very difficult to set up your own blog? I’m not very
      techincal but I can figure things out pretty quick. I’m thinking about making
      my own but I’m not sure where to start. Do you have
      any points or suggestions? Cheers

    • When you require a car crucial substitute solution you are able to call us so we
      could come directly to where you requirement the automobile locksmith solution and also execute all the work right there on site.

    • We take fantastic pride in helping regional residents with all kind of residential locksmith professional requirements, consisting of situations of broken or non-working secrets.

    • Have you ever thought about adding a little bit more than just
      your articles? I mean, what you say is fundamental and all.
      Nevertheless imagine if you added some great graphics or video clips to give your posts more, “pop”!
      Your content is excellent but with pics and video clips, this website could definitely
      be one of the best in its field. Amazing blog!

    • You actually make it appear so easy along with your presentation but
      I find this matter to be really one thing that I believe I would
      never understand. It sort of feels too complicated and very broad for me.

      I am taking a look forward to your subsequent put up, I will try to get the hang of it!

    • With havin so much content and articles do you ever run into any issues
      of plagorism or copyright infringement? My site has a lot of unique content I’ve either created myself or outsourced but
      it looks like a lot of it is popping it up
      all over the internet without my authorization. Do you know any techniques to help protect against content from
      being stolen? I’d genuinely appreciate it.

  30. Wonderful beat ! I would like to apprentice while you amend your site, how can i subscribe for a blog site? The account aided me a appropriate deal. I had been a little bit acquainted of this your broadcast provided bright transparent concept

  31. I am extremely impressed with your writing skills and also with the layout on your blog. Is this a paid theme or did you modify it yourself? Either way keep up the excellent quality writing, it is rare to see a great blog like this one these days..

    • OK, to do this you must start off by understanding that property
      prices are primarily determined by location. In fact, many people see around an 80% payback from their initial
      investment in a bathroom once they sell their homes. If
      you prefer stone, then vinyl stone looks magnificent.

  32. I’ve also found that following the meals program and using the glucomannan truly helps with feeling
    complete and noot overeating This book also guides you
    to other definitely excellent mewals alternatives and
    how adding far more protein to your daily intake will help you
    realize weight loss objectives.