Open Redirect (ARCH5122)

Key go.security.open-redirect · Severity warning · Category security · CWE CWE-601

A redirect whose destination is user-controlled lets an attacker route users through a trusted domain to a malicious site, enabling phishing.

Incorrect

func redirect(w http.ResponseWriter, r *http.Request) {
    target := r.URL.Query().Get("next")
    http.Redirect(w, r, target, http.StatusFound)
}

Correct

func redirect(w http.ResponseWriter, r *http.Request) {
    target := r.URL.Query().Get("next")
    if !strings.HasPrefix(target, "/") || strings.HasPrefix(target, "//") {
        target = "/"
    }
    http.Redirect(w, r, target, http.StatusFound)
}

Fix

Validate redirect targets against an allowlist, or only permit site-relative paths.