Hi @vS116732 (Community Member)​ ,

Veracode Static Analysis reports flaws of CWE-601: URL Redirection to Untrusted Site ('Open Redirect') if it can detect a path from a redirect to some input to the application. The concern is that an attacker may be able to abuse this input to cause your application to redirect to an attacker controlled domain.

We typically recommend that you investigate using hardcoded values (optionally select a hardcoded value from a map / enum based on user input). If you are able to ensure all dynamic input in a URL that is redirected to traces back to a hardcoded value then Veracode Static Analysis will be able to automatically close the flaw.

If you must use dynamic values from outside of the application we recommend applying validation on any dynamic input into URLs used for redirection. However, Veracode Static Analysis is blind to custom validation and will not automatically close flaws based on custom validation.

After implementing custom validation you must propose a mitigation and contact your security team to have this mitigation reviewed. You can find more information on how to propose a mitigation here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ .

Please let me know if you have any remaining questions or concerns.

Thank you,

Boy Baukema