Open Redirect

Login flows, unsubscribe links, and "continue to" pages often redirect based on a URL parameter. If that destination isn't validated, the real domain in the address bar during the initial click makes a phishing link look legitimate right up until the redirect fires.

The danger isn't the redirect itself — it's that the link starts on a domain users actually trust, which defeats the usual advice to "check the link before clicking"

Open redirects are frequently chained with OAuth token theft: an attacker crafts an authorize URL whose redirect_uri passes validation but whose final hop leaks the token

Validating that the destination is a relative path, or belongs to an explicit allowlist of domains, closes the hole

A same-site check alone is not enough — protocol-relative URLs (//evil.example) and backslash tricks (/\evil.example) are common bypasses for a naive prefix check

Want this flow explained in detail as it plays?

GET/redirect?url=https://app.flowground.dev/dashboard

Headers

Host:app.flowground.dev

Body

Stuck? Try a hint

Defense in depth

Revealed once you've worked through the hint ladder above — try the attack yourself first.

Vulnerable vs. Fixed

app.get("/redirect", (req, res) => {
  res.redirect(req.query.url); // any absolute URL is followed as-is
});