Open Redirect in Gorilla Mux

Open Redirect vulnerabilities occur when an application accepts a user-controlled URL and redirects the browser to that destination without sufficient validation. In Gorilla Mux, this commonly appears in two patterns: using query parameters or path variables to determine redirect targets, and within custom handler logic that calls http.Redirect.

Pattern 1: Query Parameter Redirection
A typical vulnerable route in Gorilla Mux might look like this:

r.HandleFunc("/login", func(w http.ResponseWriter, r *http.Request) {
    // Authenticate user...
    redirectURL := r.URL.Query().Get("next")
    if redirectURL != "" {
        http.Redirect(w, r, redirectURL, http.StatusFound)
        return
    }
    http.Redirect(w, r, "/dashboard", http.StatusFound)
}).Methods("GET")

Here, the next query parameter is used directly as the redirect target. An attacker can craft a URL like /login?next=https://evil.com to redirect authenticated users to a phishing site.

Pattern 2: Path Variable Redirection
Gorilla Mux allows capturing path elements as variables. If these are used for redirection without validation:

r.HandleFunc("/redirect/{target}", func(w http.ResponseWriter, r *http.Request) {
    vars := mux.Vars(r)
    target := vars["target"]
    http.Redirect(w, r, target, http.StatusFound)
}).Methods("GET")

Visiting /redirect/https://evil.com causes an immediate redirect to the attacker's domain. This pattern is especially dangerous if the route is intended for internal navigation but lacks host validation.

Both patterns fail to verify that the redirect URL is either relative (same-origin) or points to an allowed allowlist of domains. Gorilla Mux itself does not enforce redirect safety—it's the developer's responsibility to validate the destination before calling http.Redirect.

Static Code Analysis
To manually detect Open Redirect in a Gorilla Mux codebase, search for routes that:

• Call http.Redirect, http.RedirectPost, or set Location header with user input.
• Use r.URL.Query().Get(), r.FormValue(), or mux.Vars() to extract a URL without subsequent validation.
• Contain route definitions with parameters like {redirect}, {url}, or {next} that feed into redirect logic.

Dynamic Scanning with middleBrick
middleBrick performs black-box testing on your API endpoint to detect Open Redirect vulnerabilities. For a Gorilla Mux application, you would submit the base URL (e.g., https://api.example.com) to middleBrick. The scanner automatically:

1. Identifies redirect behavior by sending requests with test payloads like ?next=https://attacker.com or /redirect/https://attacker.com to candidate endpoints.
2. Follows HTTP 3xx responses and inspects the Location header.
3. Checks if the final redirect destination is an external, attacker-controlled domain (e.g., attacker.com or a middleBrick-controlled callback URL).
4. Correlates findings with the OpenAPI/Swagger spec (if provided) to map vulnerable routes to specific endpoints and parameters.

If middleBrick observes that an endpoint like /login redirects to an arbitrary external URL supplied via the next parameter, it flags this as an Open Redirect issue with a severity rating (typically Medium or High if chained with authentication). The report includes the exact request that triggered the vulnerability and the malicious redirect URL used in the test.

You can run this scan via the middleBrick web dashboard, the CLI (middlebrick scan https://your-api.com), or integrate it into CI/CD with the GitHub Action.

Remediation involves validating any user-supplied redirect target before passing it to http.Redirect. Gorilla Mux does not provide built-in URL validation, so you must implement it in your handlers or middleware.

1. Allowlist Valid Domains (Strictest)
If redirects should only go to your own domain or a set of trusted partners:

var allowedHosts = map[string]bool{
    "example.com": true,
    "www.example.com": true,
    "trusted-partner.com": true,
}

func validateRedirectURL(rawURL string) (string, error) {
    u, err := url.Parse(rawURL)
    if err != nil || u.Host == "" {
        return "", errors.New("invalid URL")
    }
    if !allowedHosts[u.Host] {
        return "", errors.New("host not allowed")
    }
    return rawURL, nil
}

r.HandleFunc("/login", func(w http.ResponseWriter, r *http.Request) {
    redirectURL := r.URL.Query().Get("next")
    if redirectURL != "" {
        if safeURL, err := validateRedirectURL(redirectURL); err == nil {
            http.Redirect(w, r, safeURL, http.StatusFound)
            return
        }
    }
    http.Redirect(w, r, "/dashboard", http.StatusFound)
})

2. Enforce Relative URLs (Simpler)
If all redirects should stay within the same application, ensure the URL is relative (no scheme or host):

func isRelativeURL(rawURL string) bool {
    u, err := url.Parse(rawURL)
    if err != nil {
        return false
    }
    // A relative URL has no scheme and no host.
    return u.Scheme == "" && u.Host == ""
}

r.HandleFunc("/redirect/{target}", func(w http.ResponseWriter, r *http.Request) {
    vars := mux.Vars(r)
    target := vars["target"]
    if isRelativeURL(target) {
        http.Redirect(w, r, target, http.StatusFound)
        return
    }
    http.Error(w, "Invalid redirect target", http.StatusBadRequest)
})

3. Middleware Approach
For large applications, create a Gorilla Mux middleware that validates a next parameter on relevant routes:

func redirectValidationMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if nextParam := r.URL.Query().Get("next"); nextParam != "" {
            if _, err := validateRedirectURL(nextParam); err != nil {
                http.Error(w, "Invalid redirect URL", http.StatusBadRequest)
                return
            }
        }
        next.ServeHTTP(w, r)
    })
}

r.Use(redirectValidationMiddleware)
// Now all routes will have the query param validated if present.

Important: Always normalize the URL (e.g., using url.Parse) before checking. Be aware of bypass techniques like https:example.com (missing //) or using non-standard ports. The OWASP Cheat Sheet for Unvalidated Redirects and Forwards provides comprehensive validation strategies.