I was reading An Insiders Guide to Security Review and on page 17, point 10 noticed something called Unvalidated Redirects and Forwards.

The jist here is that user might be redirected to malicious site by trusting your site.

I noticed that Site.Login() method takes in StartURL parameter. Currently project implemented this way:

String startUrl = System.currentPageReference().getParameters().get('startURL');
pagereference Attempt = Site.login(u[0].username, password, startUrl);

I was wondering if there is a valid attack vector here. What would be viable exploit and what are the ways to validate?


You are safe here, because the attacker does not control the host of the startURL parameter. If it's an absolute URL, the value will be ignored and the user will be redirected to the start page specified in your site, not the URL specified in startURL. If the field is a relative URL, then the domain will be unchanged.

Arbitrary redirects are about giving the attacker control of the host, not the path or URL parameters.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.