Skip to main content

 

 

 

Template:OutSystems/Documentation_KB/Breadcrumb_New_Layout

 

 

Template:OutSystems/OSLanguageSwitcher

 

 

 

OutSystems

Protecting Outsystems Apps From Redirects / Forwarders Vulnerabilities

Attackers can trick users by taking advantage of unvalidated redirects or forwarders. In these cases victims trust your URL but are redirected to a malicious site.

When applications redirect users to other pages using dynamic URLs in its parameters, it allows attackers to provide a valid URL with a redirect parameter to a malicious site.

The following example from the OWASP documentation shows how an unvalidated redirect can be exploited to send a user to a malicious site.

Example of how an unvalidated redirect can be exploited to send a user to a malicious site

How to do it with OutSystems

To prevent attackers from using unvalidated redirects or forwarders, the following actions are recommended:

Use case Actions
Use Dynamic URLs redirects from input parameters To prevent attackers from using unvalidated redirects or forwarders, avoid using dynamic URL external sites

If you absolutely must use them, then check the input URL against a whitelist.

To learn how to protect your OutSystems apps against other common types of attacks, check how OutSystems helps you develop secure applications.