Skip to content

Open redirect: fixing ?redirect= and ?next= links

Security · Nice to fix · vibeliq reports this as “Links on your site can bounce people anywhere”

Why it matters

A link on your trusted domain that forwards to any address is a gift to phishers: the link looks like you, but lands on them. This is a hint, so check whether the redirect is validated.

How to check it yourself

Look for links on your site with parameters named redirect, next, url or return that contain a full outside address. Try changing the address to another site: if you get forwarded there, it's open.

What the fix involves

Only allow relative paths or a fixed list of your own domains in redirect parameters, and fall back to the homepage for anything else.

Reference: cheatsheetseries.owasp.org

How vibeliq checks it

We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.

Related checks

All 38 checks