Open Redirect Chain in Aspnet (Csharp)

An open redirect chain in an ASP.NET application occurs when a URL parameter is used to redirect the user without proper validation, and the target URL itself can be chained to another external location. In C#, this commonly arises in MVC controllers or Razor Pages where a return Redirect(resultUrl) is called based on an incoming query string. Because the redirect is performed by the server, browsers treat the final destination as trusted, which can be exploited in phishing and chain attacks.

For example, an attacker can craft a link like https://example.com/Account/Redirect?url=https://evil.com?next=https://phish.example.com. If the ASP.NET endpoint does not validate or restrict the destination, the server will issue a 302 to the first URL, and the client’s browser follows the chain, ending on the malicious site. The chaining aspect means multiple redirects can be encoded in a single parameter (e.g., using encoded paths or query parameters), making detection harder for simple allowlists. Because the redirect is unauthenticated and part of the public attack surface, middleBrick’s unauthenticated scan can surface this as a BFLA/Privilege Escalation or Unsafe Consumption finding when testing the endpoint’s behavior.

In the context of middleware and ASP.NET Core, a developer might use RedirectPermanent or RedirectLocal without validating the hostname against a whitelist. The framework does not inherently prevent open redirects; it is the developer’s responsibility to ensure that the destination is safe. When combined with chaining, an attacker can obscure the final target by using intermediate domains that appear benign. This becomes a chain where each hop can add obfuscation, and the client’s browser follows the entire sequence automatically. Because the scan tests unauthenticated attack surfaces and maps findings to frameworks like OWASP API Top 10 and compliance regimes, an open redirect chain is flagged with remediation guidance to validate and restrict redirect targets.

To remediate open redirect chains in ASP.NET with C#, validate and restrict redirect destinations to a trusted set of hosts or paths. Do not use raw user input in Redirect(url). Instead, use a whitelist of allowed domains or a route-based approach that only permits relative paths or known safe hosts.

Example: Safe Redirect with Host Validation

using Microsoft.AspNetCore.Mvc;

public class AccountController : Controller
{
    private static readonly HashSet AllowedHosts = new(StringComparer.OrdinalIgnoreCase)
    {
        "app.example.com",
        "trusted.example.com"
    };

    [HttpGet]
    [Route("account/login-return")]
    public IActionResult LoginReturn(string returnUrl)
    {
        if (!TryValidateRedirectUrl(returnUrl, out var validatedUrl))
        {
            return BadRequest("Invalid return URL");
        }
        return Redirect(validatedUrl);
    }

    private bool TryValidateRedirectUrl(string url, out string validatedUrl)
    {
        validatedUrl = null;
        if (string.IsNullOrWhiteSpace(url))
        {
            return false;
        }

        // Ensure it's a relative path or a safe absolute URL
        if (Uri.TryCreate(url, UriKind.Absolute, out var uriResult))
        {
            if (AllowedHosts.Contains(uriResult.Host))
            {
                validatedUrl = uriResult.ToString();
                return true;
            }
            return false;
        }

        // Allow relative paths
        if (Uri.TryCreate("/" + url.TrimStart('/'), UriKind.Relative, out var relative))
        {
            validatedUrl = relative.ToString();
            return true;
        }

        return false;
    }
}

Example: Restrict to Relative Paths Only

[HttpGet]
[Route("account/profile")]
public IActionResult Profile(string redirect)
{
    // Only allow relative URLs to prevent external redirects
    if (string.IsNullOrEmpty(redirect))
    {
        return View();
    }

    // Ensure the path is relative and doesn't contain a host
    if (Uri.TryCreate(redirect, UriKind.Relative, out var uri) && string.IsNullOrEmpty(uri.Host))
    {
        return Redirect(redirect);
    }

    return BadRequest("Invalid redirect target");
}

Middleware-Level Validation in ASP.NET Core

For applications using custom redirect logic across many endpoints, consider a middleware that inspects query parameters named url or next and validates them before the request proceeds. This centralizes the policy and reduces the chance of missing a vulnerable endpoint.

app.Use(async (context, next)
{
    if (context.Request.Query.TryGetValue("url", out var urlValues))
    {
        var raw = urlValues.FirstOrDefault();
        if (!string.IsNullOrEmpty(raw) && !IsSafeRedirect(raw))
        {
            context.Response.StatusCode = 400;
            await context.Response.WriteAsync("Invalid redirect URL");
            return;
        }
    }
    await next();
});

By combining host whitelisting, relative-path-only policies, and centralized validation, you eliminate open redirect chains in ASP.NET C# applications. These changes ensure that even if an attacker supplies a chained URL, the server will reject unsafe destinations and prevent the browser from following to malicious sites.