Preventing Open Redirection Attacks In C# And JavaScript

There are different types of attacks that exist in web programming, like SQL Injection Attack, Cross Site Scripting Attack(XSS), Open Redirection Attack etc., and we need to take care of these attacks when writing code and trying to keep our applications from these attack.

Today, we will talk about Open Redirection Attack and see the code which prevents it at Server side level as well as client side level.

Web application works on http protocol and redirects to some URL when we click on any link or button. Sometimes, we pass URL in query string and sometimes it passes directly. But this URL can be changed by external users (hackers) and they can tamper with these URLs and redirect users to some malicious URL. This is called Open Redirection Attack.

As per CWE 601

An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.

Therefore, generally we forget to write code to prevent Open Redirection Attack. We just take the URL and redirect to it. However, this is not good way to redirect.

We need to check URL and identify “is this malicious or not?” We need to do these things at code level.

Example of Open Redirection Attack

Let's say, there is a website called “abc.com” which has one login page where users can pass their credentials to the login system. When user passes user name, password, and clicks to log in button, it redirects to some other page where credentials will validate and then it will redirect to welcome page.

However, hackers tampered with the  redirect URL of welcome page with some malicious page, which looks and feels the same as abc.com login page and they will show a message that “user name and password are incorrect”. Here generally nobody will care about URL and just retype their valid credentials and click to login. But this time user has entered their credentials with some malicious site and is being hacked.

Server Side Prevention of Open Redirection Attack

So, to prevent this type of scenario we need to write code to check URL which is processing by system, if anything goes wrong it just shows error page or redirects to login page. Generally we do redirection in Asp.Net as follows. 

if (!String.IsNullOrEmpty(returnUrl))
{
      Response.Redirect(returnUrl);
}
else
{
       Response.Redirect("login.aspx");
}

Here, we are only checking Null and Empty URL, we don’t have intention to check if URL is valid or not. To check valid URL, we will validate Request. In the following code, we are validating HttpContext.Current.Request.

We can check if the provided URL is a local URL or not, la ocal URL is that which belongs to the same domain. If URL seems to belong to outside, then it will show error page or redirect to login page. 

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Web;

namespace Helper
{
    public class RequestExtensions
    {
        System.Web.HttpRequest request = HttpContext.Current.Request;
        public bool IsLocalUrl(string url)
        {
            if (string.IsNullOrEmpty(url))
            {
                return false;
            }

            Uri absoluteUri;
            if (Uri.TryCreate(url, UriKind.Absolute, out absoluteUri))
            {
                return String.Equals(request.Url.Host, absoluteUri.Host,
                            StringComparison.OrdinalIgnoreCase);
            }
            else
            {
                bool isLocal = !url.StartsWith("http:", StringComparison.OrdinalIgnoreCase)
                    && !url.StartsWith("https:", StringComparison.OrdinalIgnoreCase)
                    && Uri.IsWellFormedUriString(url, UriKind.Relative);
                return isLocal;
            }
        }
    }
}

And before redirecting to URL, we will check and validate. If everything is fine, then we will redirect to provide URL otherwise redirect to login.aspx page. This will prevent your page from being redirected to some other domain which might not be secure or might be tampered with by third party users. So, always be sure before making any redirection. Just check the URL if it exists locally or not. 

Helper.RequestExtensions requestExtension = new RequestExtensions();
string returnUrl = Request.QueryString["redirectPage"];
if (requestExtension.IsLocalUrl(returnUrl))
{
       Response.Redirect(returnUrl);
}
else
{
       Response.Redirect("login.aspx");
}

Following code is validating if the returnURL exists locally or not.

if (requestExtension.IsLocalUrl(returnUrl))

Client Side Prevention of Open Redirection Attack

The following code is  afull example of how to check URL at client side and validate if the URL belongs to the same domain where the system is running. 

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title></title>
    <script>
               function LaunchHelp() {
            try {

                var surl = "http://www.google.com";
                if (validateURL(surl))
                    window.open(surl, '_blank', 'toolbar=no,menubar=no,status=yes');
                else {
                    throw new InvalidURLException();
                }
            } catch (e) {
                if (e instanceof InvalidURLException)
                    alert(e.message);
            }
        }

        function InvalidURLException() {
            this.message = "An attempt was made to open a webpage of foreign domain. No allowed.";
            this.toString = function () {
                return this.message
            };
        }

        function validateURL(surl) {
            var url = parseURL(surl);
            var urlHostname = url.hostname.trim();

            if (urlHostname == '') {
                return true;
            }
            else {
                if (urlHostname.toUpperCase() == location.hostname.trim().toUpperCase()) {
                    return true;
                }
                else
                    return false;
            }
        }

        function parseURL(url) {
            var a = document.createElement('a');
            a.href = url;
            return {
                source: url,
                protocol: a.protocol.replace(':', ''),
                hostname: a.hostname,
                host: a.host,
                port: a.port,
                query: a.search,
                params: (function () {
                    var ret = {},
                        seg = a.search.replace(/^\?/, '').split('&'),
                        len = seg.length, i = 0, s;
                    for (; i < len; i++) {
                        if (!seg[i]) { continue; }
                        s = seg[i].split('=');
                        ret[s[0]] = s[1];
                    }
                    return ret;
                })(),
                file: (a.pathname.match(/\/([^\/?#]+)$/i) || [, ''])[1],
                hash: a.hash.replace('#', ''),
                path: a.pathname.replace(/^([^\/])/, '/$1'),
                relative: (a.href.match(/tps?:\/\/[^\/]+(.+)/) || [, ''])[1],
                segments: a.pathname.replace(/^\//, '').split('/')
            };
        }



    </script>
</head>
<body>
    <h1>This is Test 1 Page.</h1>
    <button id="btnRedirect" name="btnRedirect" onclick="LaunchHelp()">Redirect</button>
</body>
</html>

Conclusion

So, today we have learned how to prevent Open Redirection Attack at server side as well as client side.

I hope this post will help you. Please put your feedback using comment which helps me to improve myself for next post. If you have any doubts please ask your doubts or queries in the comment section and If you like this post, please share it with your friends. Thanks