Open redirect (ARCH4122)

Key java.security.open-redirect · Severity warning · Category security · CWE CWE-601

Taking the redirect target straight from user input lets attackers send victims to malicious sites through your trusted domain, enabling phishing.

Incorrect

@GetMapping("/redirect")
public String redirect(@RequestParam String url) {
    return "redirect:" + url;
}

Correct

private static final Set<String> ALLOWED = Set.of("/home", "/dashboard");

@GetMapping("/redirect")
public String redirect(@RequestParam String url) {
    return ALLOWED.contains(url) ? "redirect:" + url : "redirect:/home";
}

Fix

Validate redirect targets against an allowlist, or accept only application-relative paths.