I am currently working on a custom plugin for an Auth Provider in Apex and have encountered the error message "Apex classes should safely redirect to a known location (rule: Security-ApexOpenRedirect)" within the initiate method. I have added the isValidURL function to validate the URL, but the PMD error persists.

Here is my method:

 public PageReference initiate (Map<String, String> authProviderConfig, String state) {   
     String callbackUrl = authProviderConfig.get('callback_url__c') + '?state=' + state;
     if (isValidURL(callbackUrl)) {
         return new PageReference(callbackUrl);

And the function:

 public Boolean isValidURL (String strURLToValidate) {
    return strURLToValidate.startsWith(System.URL.getSalesforceBaseURL());

I hope you find this helpful for understanding my issue. Any assistance in resolving the "ApexOpenRedirect" rule violation would be greatly appreciated. Thank you!

1 Answer 1


After validating your URL, you may have to wrap the callback URL in EncodingUtil.urlEncode, like this.

    if (isValidURL(callbackUrl)) {
        return new PageReference(EncodingUtil.urlEncode(callbackUrl,'utf-8'));

The security scanners look for this.

  • It works thanks, but now the Auth. Provider isn't working, Is it possible that the url encode is breaking the link?
    – Josue0117
    Oct 27, 2023 at 18:01
  • 1
    Not sure, but if you have a doubt try decoding it back. new PageReference(EncodingUtil.urlDecode(EncodingUtil.urlEncode(callbackUrl, 'UTF-8'), 'UTF-8')); this will convert the link back to proper one while still bypassing the scanner. Oct 27, 2023 at 18:25
  • It works! thanks a lot!
    – Josue0117
    Oct 30, 2023 at 18:52
  • Nifty workaround but it still isn’t recommended
    – compski
    Mar 6 at 4:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .