Open redirect (ARCH7122)

Key php.security.open-redirect · Severity warning · Category security · CWE CWE-601

Taking a redirect target from user input without validation lets attackers redirect users to malicious sites via a trusted domain. The target must be restricted to an allowlist or site-relative paths only.

Incorrect

<?php
$next = $_GET['next'];
header('Location: ' . $next);
exit;

Correct

<?php
$next = $_GET['next'] ?? '/';
// allow only site-relative paths
if (!preg_match('#^/[a-zA-Z0-9/_-]*$#', $next)) {
    $next = '/';
}
header('Location: ' . $next);
exit;

Fix

Validate the redirect target against an allowlist or restrict it to site-relative paths only.