News for hackers. Stuff that matters.

A comment on HTTP Response Splitting Vulnerability on reddit.com.

Re:HTTP Response Splitting Vulnerability on reddit.com by d_r on Saturday January 15, 2011 @08:27PM (#2108316)
Is it ever reasonable to pass a redirect URL directly via the GET parameters? One other concern would be the ease of phishing attacks, e.g.

goodsite.com/login?redirect=http://www.mybadsite.com

User logs in to Goodsite, and is redirected to a similar-looking page on Badsite.

One safer alternative would be to store the redirect URL in the session (presuming one is available) and read it back later.

[ Parent | on HN ]
Re:HTTP Response Splitting Vulnerability on reddit.com by nbpoole on Saturday January 15, 2011 @08:41PM (#2108347)
You're talking about what's known as an open redirect. And you're correct: those can definitely be used to make a phishing attack more effective. But as I mentioned, reddit only redirects users to reddit content: you need to provide a relative URL or use a reddit subdomain (eg: http://code.reddit.com) in the dest parameter.
[ Parent | on HN ]