When redirects are implemented in Node.js and/or Express, it's important to perform input validation on the server-side. If an attacker discovers that you are not validating external, user-supplied input, they may exploit this vulnerability by posting specially-crafted links on forums, social media, and other public places to get users to click it.
Example: Unsafe express redirect using user input
const express = require('express');
const app = express();
app.get('/login', (req, res, next) => {
if (req.session.isAuthenticated()) {
res.redirect(req.query.url);
}
}); The suggested fix to avoid unsafe redirects is to avoid relying on user input. If user input must be used, safe redirect whitelists can be used to avoid exposing the vulnerability.
Example: Safe redirect whitelist
const whitelist = {
'https://google.com': 1
};
function getValidRedirect(url) {
// check if the url starts with a single slash
if (url.match(/^\/(?!\/)/)) {
// Prepend our domain to make sure
return 'https://example.com' + url;
}
// Otherwise check against a whitelist
return whitelist[url] ? url : '/';
}
app.get('/login', (req, res, next) => {
if (req.session.isAuthenticated()) {
res.redirect(getValidRedirect(req.query.url));
}
}); From the blog by NodeSwat:
Fortunately the mitigation methods for this vulnerability are quite straightforward — don’t use unvalidated user input as the basis for redirect.
From the blog by Hailstone
However, if the server-side redirect logic does not validate data entering the url parameter, your users may end up on a site that looks exactly like yours (examp1e.com), but ultimately serves the needs of criminal hackers!