How to fix Open Redirection (DOM-Based) Vulnerability

Karthik K

Hi All ,

How to fix the Open Redirection (DOM-Based) Vulnerability in asp.net application. Is there any setting in webconfig file or have to do in specific page while we redirect . I have show the code when redirect . Suggest me with suitable solution for this issue .

Afer successful login - > redirect to dashboard.aspx page

Response.Redirect("Dashboard.aspx", false);

Thanks in advance ,

Karthik.K

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Rijwan Ansari4y ago
Accepted answer
There is no single action you can take to eliminate the threat of DOM-based attacks entirely. However, generally speaking, the most effective way to avoid DOM-based vulnerabilities is to avoid allowing data from any untrusted source to dynamically alter the value that is transmitted to any sink.
If the desired functionality of the application means that this behavior is unavoidable, then defenses must be implemented within the client-side code. In many cases, the relevant data can be validated on a whitelist basis, only allowing content that is known to be safe. In other cases, it will be necessary to sanitize or encode the data. This can be a complex task, and depending on the context into which the data is to be inserted, may involve a combination of JavaScript escaping, HTML encoding, and URL encoding, in the appropriate sequence.

However, You can apply CORS to prevent one level.
Cross Origin Resource Sharing (CORS) is a W3C standard that allows a server to relax the same-origin policy. Using CORS, a server can explicitly allow some cross-origin requests while rejecting others.
https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api
Sachin Singh4y ago
In ASP.NET Core and ASP.NET MVC we have Redirect.ToLocal() method which is not available in webforms, so be a programmer and implement the same from your side.
private bool IsLocalUrl(string url)
{
    if (string.IsNullOrEmpty(url))
    {
        return false;
    }

    Uri absoluteUri;
    if (Uri.TryCreate(url, UriKind.Absolute, out absoluteUri))
    {
        return String.Equals(this.Request.Url.Host, absoluteUri.Host,
                    StringComparison.OrdinalIgnoreCase);
    }
    else
    {
        bool isLocal = !url.StartsWith("http:", StringComparison.OrdinalIgnoreCase)
            && !url.StartsWith("https:", StringComparison.OrdinalIgnoreCase)
            && Uri.IsWellFormedUriString(url, UriKind.Relative);
        return isLocal;
    }
}

void DashBoardLogin(object sender, EventArgs e)
{
    string returnto = Request.QueryString["ReturnUrl"];
    if (returnto != "" and isLocalUrl(returnto)) Response.Redirect(returnto);
}
Srinivasan Ramamoorthi4y ago
You can do below steps to resolve this

Maintain the list of URLs that you are redirecting in a separate resource or config file and use them in Response.Redirect using id or Key

Other option is validate the URLs that you are redirecting using regex. so that the URL contains the right format and there are no chances of redirecting to another website.