Open Redirect in Loopback with Hmac Signatures

An open redirect in a Loopback application that uses Hmac Signatures can occur when a redirect target is derived from user-controlled input and the Hmac is computed only over trusted parameters, omitting the final redirect URL. An attacker can supply a malicious redirect URL and a valid Hmac for a subset of parameters, causing the server to follow the untrusted URL after signature verification.

Consider an endpoint that accepts url and return_to query parameters. If the Hmac is generated over url but not over return_to, an attacker can provide their own return_to while using a valid Hmac for a benign url. Because the signature validates successfully, the server may perform the redirect to the attacker-controlled location.

In Loopback, this can be triggered via routes that use query-based redirection without binding the redirect target to the signed context. For example, an OAuth-like flow where next or redirectTo is not validated against the Hmac allows an attacker to chain a trusted signature with an untrusted destination. The server trusts the signature and proceeds with the redirect, effectively becoming an open redirect conduit.

Real-world impact includes phishing lures that appear to originate from a trusted domain, abuse in business logic flows such as post-login redirects, and potential use in cross-site phishing or client-side injection chains. This pattern is especially dangerous when combined with social engineering, as users may perceive the URL as legitimate due to the valid signature.

During a middleBrick scan, such misconfigurations are surfaced under the Authentication and BFLA/Privilege Escalation checks, highlighting insecure redirect handling even when Hmac Signatures are present.

To remediate open redirect risks when using Hmac Signatures in Loopback, ensure the redirect target is either derived from a trusted allowlist or included in the signed payload so that any tampering invalidates the signature.

Below is a secure Loopback example where the redirect URL is part of the signed data. The server computes the Hmac over a structured object that includes the redirect target, and it verifies the signature before performing the redirect. This prevents an attacker from swapping the redirect destination without breaking the signature.

const crypto = require('crypto');
const loopback = require('loopback');
const app = loopback();

const SHARED_SECRET = process.env.HMAC_SECRET;

function computeHmac(payload) {
  const keys = Object.keys(payload).sort();
  const message = keys.map(k => `${k}:${payload[k]}`).join('|');
  return crypto.createHmac('sha256', SHARED_SECRET).update(message).digest('hex');
}

app.get('/auth/callback', (req, res) => {
  const { redirectTo, timestamp, nonce, signature } = req.query;

  // Reconstruct the payload exactly as signed
  const payload = { redirectTo, timestamp, nonce };
  const expected = computeHmac(payload);

  if (signature !== expected) {
    return res.status(401).send('Invalid signature');
  }

  // Validate redirectTo against an allowlist or strict pattern
  const allowedHosts = new Set(['app.example.com', 'cdn.example.com']);
  try {
    const url = new URL(redirectTo);
    if (!allowedHosts.has(url.hostname)) {
      return res.status(400).send('Redirect not allowed');
    }
  } catch (err) {
    return res.status(400).send('Invalid redirect URL');
  }

  // Perform safe redirect
  res.redirect(redirectTo);
});

Key points in the fix:

• The redirect target redirectTo is included in the Hmac computation, so an attacker cannot change it without invalidating the signature.
• Host validation ensures only pre-approved domains are allowed, implementing a strict allowlist rather than a blacklist.
• Timestamp and nonce are included to prevent signature replay, aligning with best practices for signed redirects.

Alternative approach: If including the redirect target in the signed context is not feasible, resolve the target server-side from a trusted mapping (e.g., a short-lived token to a known path) and exclude the raw user-supplied URL from the redirect decision entirely.

In a production Loopback application, you can integrate this pattern into existing authentication flows and validate it using middleBrick’s CLI: middlebrick scan <url> to confirm that the endpoint no longer exhibits open redirect behavior under the Authentication and BFLA/Privilege Escalation checks.