ASP.NET Core MVC Interview Question #119

What is an open redirect vulnerability in MVC?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

An open redirect occurs when an application redirects to a user-controlled URL without verifying that the destination is safe. Attackers can use a trusted site's login or navigation flow to send users to a malicious external site.

Detailed Explanation

For returnUrl scenarios, validate that the destination is local before redirecting. MVC provides helpers such as Url.IsLocalUrl and LocalRedirect.

Code Example

if (!string.IsNullOrEmpty(returnUrl) &&
    Url.IsLocalUrl(returnUrl))
{
    return LocalRedirect(returnUrl);
}

return RedirectToAction("Index", "Home");