Unvalidated Redirects and Forwards
Common website functions, such as search results or account logins, frequently use redirects or forwards to send visitors to another destination. The web address often references the destination, which is displayed after url=. For example:
http://www.coolexample.com/search?q=yellow&url=coolexample.net
If the website doesn't verify the destination, redirects or forwards might be vulnerable to modification. An attacker can change the destination address to send visitors to a malicious site that appears to be part of the original location. Phishing schemes often exploit unvalidated redirects and forwards, because an attacker can hide a malicious URL behind the original address.
The easiest way to prevent vulnerabilities with redirects and forwards is not to use them on your website. If that's not possible, set up a whitelist for "safe" destinations, and consider disallowing off-site redirects.
To learn more about unvalidated redirects and forwards and other common vulnerabilities, see the Open Web Application Security Project's Top 10 Most Critical Web Application Security Risks.
