Open Redirect in Echo Go with Hmac Signatures

An open redirect in Echo Go combined with Hmac Signatures can occur when a redirect target is derived from a query or header value that is only validated for signature integrity, not for safe destination semantics. Echo Go is a common HTTP router framework, and Hmac Signatures are often used to ensure that a redirect parameter has not been tampered with. The vulnerability arises when the application verifies the Hmac but does not enforce an allowlist of permitted redirect locations or validate that the destination belongs to the same service.

Consider a flow where a client-supplied next parameter is signed with a server-side key and later used to redirect after login. An attacker can supply a malicious external URL, and as long as the Hmac verification passes (for example, because the attacker can include the malicious URL inside the signed payload), the server will redirect the user. Because the signature is valid, Echo Go processes the request as expected, but the trust placed in the signature is misplaced: the signature guarantees integrity, not trustworthiness of the target.

This pattern is common in OAuth return URLs and post-login flows. The risk is amplified when the Hmac is computed over only the redirect value without additional context (such as a per-request nonce or session binding), enabling replay or selective manipulation. An attacker might not need to break the Hmac if they can trick a victim into using a known signed value they control, especially in situations where the signature window is broad or lacks tight constraints like timestamp validation.

In a black-box scan, middleBrick tests this combination by submitting redirect parameters with both benign and malicious values, checking whether the response performs an HTTP 3xx to an external domain despite the presence of a valid Hmac. It also examines whether the signature scope includes contextual data beyond the raw URL, and whether the application performs any server-side destination allowlisting. Without such controls, the Hmac-protected redirect remains an open redirect vector.

Remediation centers on ensuring that the redirect destination is constrained before the Hmac is computed and verified, and that verification includes contextual binding. Do not rely on Hmac alone to enforce safe destinations; treat the signed value as an integrity mechanism, not an authorization mechanism.

First, use an allowlist of permitted redirect paths (e.g., relative paths or exact host+path combinations). Only after selecting a safe target should you compute the Hmac over that target plus any additional binding context, such as a user identifier or a timestamp with limited validity.

Example of a secure approach in Echo Go:

// Define allowed redirect paths
var allowedRedirects = map[string]bool{
    "/dashboard": true,
    "/profile":   true,
    "/settings":  true,
}

// signRedirect builds a signed redirect value
func signRedirect(target string, userID string, key []byte) string {
    // Ensure target is allowed before signing
    if !allowedRedirects[target] {
        target = "/dashboard" // safe default
    }
    timestamp := time.Now().Unix()
    payload := fmt.Sprintf("%s|%s|%d", target, userID, timestamp)
    mac := hmac.New(sha256.New, key)
    mac.Write([]byte(payload))
    signature := hex.EncodeToString(mac.Sum(nil))
    return fmt.Sprintf("%s?next=%s&user_id=%s&ts=%d&sig=%s", "/login", url.QueryEscape(target), url.QueryEscape(userID), timestamp, signature)
}

// verifyRedirect validates the signature and destination
func verifyRedirect(r *echo.Request, key []byte) (string, error) {
    target := r.FormValue("next")
    userID := r.FormValue("user_id")
    ts, errT := strconv.ParseInt(r.FormValue("ts"), 10, 64)
    sig := r.FormValue("sig")
    if errT != nil {
        return "", errors.New("invalid timestamp")
    }
    // Enforce short validity window
    if time.Since(time.Unix(ts, 0)) > 5*time.Minute {
        return "", errors.New("timestamp expired")
    }
    // Recompute Hmac over the received components
    payload := fmt.Sprintf("%s|%s|%d", target, userID, ts)
    mac := hmac.New(sha256.New, key)
    mac.Write([]byte(payload))
    expected := hex.EncodeToString(mac.Sum(nil))
    if !hmac.Equal([]byte(expected), []byte(sig)) {
        return "", errors.New("invalid signature")
    }
    // Final allowlist check on the resolved target
    if !allowedRedirects[target] {
        return "", errors.New("disallowed redirect target")
    }
    return target, nil
}

// Handler example
func loginHandler(c echo.Context) error {
    key := []byte("your-32-byte-secret-key-should-be-secure")
    redirect, err := verifyRedirect(c.Request(), key)
    if err != nil {
        return c.String(http.StatusBadRequest, "invalid request")
    }
    return c.Redirect(http.StatusFound, redirect)
}

Key points: validate the destination against an allowlist before signing and again before redirecting; bind the signature to a per-request context (user ID, timestamp); enforce a short timestamp window to limit replay; and never redirect solely based on a client-supplied URL, even if the Hmac is valid. Using middleBrick’s CLI (middlebrick scan <url>) can help detect whether your endpoints exhibit open redirect behavior despite Hmac usage.