An open redirect is a vulnerability in which a web application uses a URL parameter value as a redirect destination without validating it. It is one of the major web security risks defined by OWASP (Open Web Application Security Project).
Here is a concrete example. With a URL like "https://trusted-site.com/redirect?url=https://evil-site.com", if trusted-site.com redirects to the url parameter value without validation, the user clicks what appears to be a link on a trusted domain but ends up on a malicious site.
Open redirects are exploited in phishing attacks because a trusted domain's URL serves as the entry point. Email security filters and users performing visual checks tend to judge a link as safe if it starts with a legitimate domain.
URL shortening services are inherently redirect services, making them closely related to the open redirect problem. Malicious actors using shortening services to create links to phishing sites is a real-world occurrence. As countermeasures, major shortening services implement malware scanning, blacklist matching, and splash pages (warning screens displayed before redirecting).
To prevent open redirects in your own applications, effective measures include restricting redirect destinations to a whitelist, allowing only relative URLs, and validating the redirect target's domain. Implementations that pass URL parameters directly as redirect destinations should be avoided in all cases. Related books are also available on Amazon.