Open Redirect in Django with Basic Auth

An open redirect in Django combined with HTTP Basic Auth can expose applications to credential phishing and unauthorized redirection when the redirect target is derived from user-controlled input. In this scenario, a developer may use a Basic Auth username and password to gate access to a view, then redirect the user to a URL specified in a query parameter such as next. If the application does not validate or strictly restrict the destination, an authenticated user can supply a malicious external URL and bypass intended post-login flows.

Consider a view that authenticates via Basic Auth using Django’s HttpRequest and checks the Authorization header manually. Even when credentials are verified, a missing validation on the redirect target enables an attacker who knows the endpoint to craft a URL like /login?next=https://evil.com. Because the user’s browser already sent valid Basic Auth credentials, the redirect appears to originate from your domain, increasing the likelihood that the user will follow the external link and disclose credentials or session tokens.

From a scanning perspective, this pattern is flagged as an open redirect because the application performs an unvalidated redirect based on attacker-influenced data. When combined with Basic Auth, the risk is compounded: the presence of credentials may encourage users to trust the redirect, and the authentication state persists across the redirect boundary. This can lead to session fixation or phishing pages that mimic the protected area of your application. Proper validation of the target host and use of relative paths or allowlists is essential to prevent abuse while preserving legitimate post-login navigation.

To mitigate open redirects in Django while using Basic Auth, ensure that redirect targets are restricted to trusted paths or domains and that authentication does not implicitly authorize arbitrary redirects. Below are concrete examples demonstrating safe patterns.

Example 1: Safe redirect with a hardcoded default and host validation

from django.http import HttpResponseRedirect, HttpRequest
from urllib.parse import urlparse

def is_safe_url(url: str, allowed_hosts: set[str]) -> bool:
    parsed = urlparse(url)
    return parsed.scheme in ('http', 'https') and parsed.netloc in allowed_hosts

def login_view(request: HttpRequest):
    allowed = {'example.com', 'app.example.com'}
    next_url = request.GET.get('next', '/dashboard/')
    if not is_safe_url(next_url, allowed):
        next_url = '/dashboard/'
    # Perform Basic Auth check here (e.g., parse request.META.get('HTTP_AUTHORIZATION'))
    return HttpResponseRedirect(next_url)

Example 2: Using Django’s built-in redirect behavior with a relative path

from django.shortcuts import redirect
from django.http import HttpRequest

def profile_view(request: HttpRequest):
    # Basic Auth verification omitted for brevity
    # Always prefer a relative path for post-login redirection
    return redirect('/settings/')

Example 3: Rejecting redirects when credentials are present

from django.http import HttpResponse, HttpResponseRedirect
from django.conf import settings

def secure_view(request):
    auth = request.META.get('HTTP_AUTHORIZATION', '')
    if auth.startswith('Basic '):
        # Credentials were provided; avoid untrusted redirects entirely
        return HttpResponse('Redirect target not allowed when authenticated.', status=400)
    # Proceed with normal logic
    return HttpResponseRedirect('/home/')

These examples emphasize explicit allowlists, relative paths, and avoiding untrusted input for redirects when authentication headers are present. By decoupling authentication from redirection logic and validating the destination host, you reduce the attack surface for open redirect abuse in Django applications that rely on Basic Auth.

Open redirects are listed in the OWASP API Top 10 and map to patterns where user-supplied URLs can manipulate navigation. When combined with Basic Auth, improper handling can violate expectations around trust boundaries and session integrity. Proper redirect validation supports compliance with security frameworks by ensuring that authenticated flows do not lead to uncontrolled external navigation.