Web Security · Middle · Question 74 of 75

A login page redirects to `?next=` after success. How can that be abused?

✓Correct answer: Open redirect: ?next=https://evil.com sends users from your trusted domain to a phishing site
2It makes the page load twice
3It leaks the user's password in the URL

Explanation

Allow only relative paths or an allowlist of destinations, and watch out for tricks like //evil.com or /\evil.com.

Further reading

OWASP: Unvalidated Redirects and Forwards Cheat Sheet ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.