Plenty of features redirect the user after an action: a login that returns you to where you were, a share link, an out link. When an assistant builds one, it tends to read the destination from the request and redirect there directly. That is an open redirect, and its danger is not the redirect itself but whose trust it borrows: a link on your domain that quietly sends the visitor somewhere else.
How it works
The destination comes from user input and is used without checking, so an attacker sets it to their own site:
// the vulnerable pattern: redirect to whatever the URL says
app.get("/go", (req, res) => {
res.redirect(req.query.url); // ?url=https://evil.com
});Now yoursite.com/go?url=https://evil.com is a link that starts on your trusted domain and lands on the attacker's. That is exactly what makes phishing links convincing, and it can also carry off tokens that happen to be in the URL.
Want to see exactly what Prbl flags? Watch it scan a demo app, no repo or account needed.
See a live scan →The fix: you choose the destination, not the request
Never redirect to a raw URL from input. Redirect to internal paths, or match against an allow-list and fall back to a safe default:
const allowed = new Set(["/dashboard", "/settings", "/"]);
app.get("/go", (req, res) => {
const target = req.query.url;
res.redirect(allowed.has(target) ? target : "/");
});The full walkthrough is in the fix for an open redirect. It is the same structural idea as other input-trust bugs: constrain the value to a set you control rather than trusting what arrives.
Frequently asked questions
What is an open redirect?
It is a redirect where the destination comes from user input without being checked, so an attacker can point it anywhere. A link like yoursite.com/go?url=https://evil.com looks like it belongs to your domain, but it sends the visitor to the attacker's site. The trust the user places in your domain gets borrowed to make a malicious link look safe.
Why does it matter if it just redirects?
Because the redirect launders trust. Phishing links work better when they start on a domain the victim recognizes, and an open redirect on your site does exactly that. It is also used to bypass protections that allow-list your domain, and to steal tokens when a redirect carries them in the URL. A redirect that trusts its input is a real foothold, not a cosmetic issue.
Where do open redirects show up in AI-built apps?
In any flow that sends the user somewhere after an action: a login that redirects to a returnUrl, a share or out link, a post-checkout redirect. The assistant reads the destination from a query parameter and calls redirect on it directly, because that makes the feature work. Nothing checks that the destination belongs to your app.
How do I fix it without breaking legitimate redirects?
Do not redirect to a raw URL from input. Redirect only to paths within your own app, or match the destination against an allow-list of approved URLs and fall back to a safe default if it does not match. If you must support external destinations, keep a strict allow-list of the specific ones you permit. The rule is that the destination is chosen by you, not by the request.
Check your redirect flows
Any redirect that takes its destination from the request is worth a look, and a scan flags the pattern. Run a free scan and see whether any redirect in your app trusts its input.