Open Redirect in Fiber with Cockroachdb

An Open Redirect in a Fiber application that uses Cockroachdb typically arises when a handler accepts a user-supplied URL or path and then redirects without strict validation. If the target for the redirect is constructed using data from Cockroachdb—such as a tenant-specific hostname or a dynamic route stored in a row—attackers can supply a malicious Cockroachdb record or manipulate query parameters to point the redirect to an arbitrary site.

Consider a scenario where an authenticated route retrieves a redirect URL from a Cockroachdb table (e.g., a configured callback URL for a service) and uses it directly in redirect(code, target). If the application does not validate that the stored URL belongs to the application’s domain or a tightly scoped allowlist, an attacker who can influence the Cockroachdb content (via compromised credentials or a secondary injection) can cause victims to be redirected to phishing sites. Even without direct database write access, insufficient validation of the retrieved value can turn a trusted data source into an open redirect vector.

The risk is compounded when query parameters are used to select redirect destinations. For example, a handler might read a return_to query param and combine it with a base obtained from Cockroachdb. If the base is attacker-controlled or not strictly validated, the combination enables an open redirect that appears to originate from a legitimate domain, bypassing naive referrer checks or origin checks.

To remediate open redirects, always treat redirect targets as untrusted and validate them against a strict allowlist or a known-safe set of domains. When using Cockroachdb, ensure that any redirect-related fields are constrained at the schema and application level, and avoid concatenating user input with database values without canonicalization and validation.

Below are concrete Fiber code examples using a Cockroachdb driver (e.g., pgx with cockroachdb connection string). These examples show safe retrieval and strict validation before redirecting.

// Example: Safe redirect with Cockroachdb in Fiber
package main

import (
	"context"
	"fmt"
	"net/url"
	"strings"

	"github.com/gofiber/fiber/v2"
	"github.com/jackc/pgx/v5/pgxpool"
)

// allowedRedirectDomains is an allowlist of hostnames this app may redirect to.
var allowedRedirectDomains = map[string]bool{
	"app.example.com": true,
	"dashboard.example.com": true,
}

func safeRedirectHandler(db *pgxpool.Pool) fiber.Handler {
	return func(c *fiber.Ctx) error {
		// Retrieve a redirect target from query parameters; treat as untrusted.
		raw := c.Query("target")
		if raw == "" {
			// Fallback to a safe, application-specific route.
			return c.Redirect("/dashboard", fiber.StatusSeeOther)
		}

		// Parse and validate the raw target.
		target, err := url.Parse(raw)
		if err != nil {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid redirect URL"})
		}

		// Ensure the target uses HTTPS to prevent downgrade attacks.
		if target.Scheme != "https" {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "redirect target must use HTTPS"})
		}

		// Enforce same-domain or explicit allowlist matching.
		if !allowedRedirectDomains[target.Host] {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "redirect target not allowed"})
		}

		// Optionally, verify that the target is not pointing to a path that could lead to open redirects internally.
		// For example, ensure no path traversal or wildcard host patterns.
		if strings.Contains(target.Host, "..") {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid host"})
		}

		// If validation passes, perform the redirect.
		return c.Redirect(target.String(), fiber.StatusFound)
	}
}

// Example: Retrieve a stored redirect URL from Cockroachdb and validate it before use.
func getStoredRedirectHandler(db *pgxpool.Pool) fiber.Handler {
	return func(c *fiber.Ctx) error {
		var storedURL string
		row := db.QueryRow(context.Background(), "SELECT callback_url FROM tenant_settings WHERE tenant_id = $1", c.Params("tenantId"))
		if err := row.Scan(&storedURL); err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to retrieve settings"})
		}

		// Validate the stored URL before using it in a redirect.
		parsed, err := url.Parse(storedURL)
		if err != nil || !allowedRedirectDomains[parsed.Host] || parsed.Scheme != "https" {
			// Fallback to a safe default if the stored value is not trustworthy.
			return c.Redirect("/dashboard", fiber.StatusSeeOther)
		}

		return c.Redirect(parsed.String(), fiber.StatusFound)
	}
}

Key practices:

Do not trust values stored in Cockroachdb for redirects; validate them with the same rigor as user input.
Use an allowlist of hostnames rather than a blocklist of known bad domains.
Enforce HTTPS to avoid downgrade attacks and ensure the parsed URL does not contain unexpected credentials or fragments.
Avoid using the Referer header for redirect decisions, as it can be omitted or spoofed by clients.