Authentication services providing open redirect services

Many authentication services like the one provided by Airlock redirect the client after successful authentication to the page the user initially requested. To do this Airlock stores the initially requested URI in an URL parameter with the name Location. To prevent phishing attacks, this parameter should be validated by the WAF or authentication service before it is used to create an HTTP redirect for the client.

Compass Security AG published a security advisory about this kind of vulnerability in authentication services [1]. The advisory further points out that it is not enough to check whether the parameter value starts with a slash to guarantee that the redirect does not point to a resource on a foreign domain. The reason for this is because according RFC 1808 (section 2.4.3) absolute URLs can be defined in the format //<domain>/path which is therefore similar to the URL http(s)://<domain>/path.