Unit 2: URLs, methods and redirects · Lesson 4 of 5 · 22 min

Project: review the redirect helpers

Check whether the shop's redirect helpers can bounce users to any site, and what the fix looks like.

mission

You are
The analyst reviewing the shop.
Situation
The shop has two helpers that send users on after an action: /go?next= and the newer /continue?next=. Phishing crews love a trusted link that forwards to their own site.
Goal
Test both helpers with an outside address and decide which one is safe.
Hand in
A finding for the unsafe helper, with the fix the safe one already uses.

Why a forwarding link matters

0/3
usershoplookalike siteclicks shop link302 Location: nextfollows the redirect

Press play or step through.

01

Normal use

learner@web-lab
curl -sI 'http://127.0.0.1:8000/go?next=/shop' | grep -E '^HTTP|^Location'
HTTP/1.1 302 Found
Location: /shop

you should see 302 to the shop page, as intended.

02

An outside address

Use a reserved example domain. You only ever test this against your own lab.

learner@web-lab
curl -sI 'http://127.0.0.1:8000/go?next=https://login.example.net/' | grep -E '^HTTP|^Location'
HTTP/1.1 302 Found
Location: https://login.example.net/

you should see The shop forwards to a site it does not own. A link that starts with the shop's name can now land anywhere.

03

Test the newer helper

learner@web-lab
curl -sI 'http://127.0.0.1:8000/continue?next=https://login.example.net/' | grep -E '^Location'
Location: /
curl -sI 'http://127.0.0.1:8000/continue?next=//login.example.net/' | grep -E '^Location'
Location: /
curl -sI 'http://127.0.0.1:8000/continue?next=/account' | grep -E '^Location'
Location: /account

you should see Outside addresses fall back to /, including the //host trick. Paths on the shop still work.

defender tip //host/ is a scheme-relative URL: browsers read it as another site. A check that only looks for http misses it.

The two helpers

/go
target = query["next"]
redirect(target)

Any address goes.

/continue
target = query["next"]
if not target.startswith("/") or target.startswith("//"):
    target = "/"
redirect(target)

Only paths on the same site.

What a defender takes away

  1. 1A redirect target taken from the request must be limited to your own site or a fixed list.
  2. 2Test https://, //host and backslash variants, not just one.
  3. 3Open redirects make phishing links look trustworthy, so they are worth a ticket.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.