NPatel336248 (Community Member) asked a question.
Veracode issue with Response.redirect()
I'm using Response.redirect in my c# to redirect to internal web pages of my application but in security scan Veracode says it is open redirect flaw.
Before passing url to response.redirect i always validate url to chech whether it is local url and not external link within url. response.redirect is always in scope of IF{}, whenever url validation is returned true then only response.redirect is called. else user is redirected to error page in application.
I already sed cleansing methods as suggested by Veracode but it still fails.
PLease guide me how to solve this issue. Any code sample would help a lot. Thanks in advance.
Nimesh
.png){kind=logo}
Hi @NPatel336248 (Community Member) ,
Veracode Static Analysis reports flaws of CWE-601: URL Redirection to Untrusted Site ('Open Redirect') if it can detect a path from a redirect to some input to the application. The concern is that an attacker may be able to abuse this input to cause your application to redirect to an attacker controlled domain.
We typically recommend that you apply validation on any dynamic input into URLs used for redirection. However, Veracode Static Analysis is blind to custom validation and will not automatically close flaws based on custom validation.
After implementing custom validation you must propose a mitigation and contact your security team to have this mitigation reviewed. You can find more information on how to propose a mitigation here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ .
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema