php-open-redirect-audit

To audit PHP code for open redirect vulnerabilities, trace user-controlled inputs like $_GET and $_POST to redirect sinks such as header("Location") and verify allowlists. This process identifies unsafe destinations and generates remediation reports with concrete fixes.

An open redirect vulnerability in PHP occurs when user-controlled inputs determine redirect destinations without proper validation. This enables phishing, OAuth flow hijacking, and session misdirection if the target URL lacks server-side allowlists or normalization checks.

Open redirect security audits map framework redirect helpers like redirect() and to() as distinct redirect sinks. The audit traces controllability from input sources through internal wrappers that output Location headers across file boundaries to ensure comprehensive vulnerability detection.

Yes, the audit explicitly checks redirect normalization logic and allowlists. It verifies whether server-side allowlists restrict destinations to relative paths and whether scheme normalization effectively blocks unsafe URLs originating from sources like Referer or return_to parameters.

The best way to fix user-controlled redirect destinations in PHP is to enforce server-side allowlists, restrict redirects to relative paths, and normalize URL schemes. The audit outputs PoC-style evidence alongside these concrete remediation paths.

Yes, the open redirect audit works across multiple PHP file boundaries and framework usage. It performs trace-based evidence gathering, mapping input sources to redirect sinks throughout the entire codebase to identify controllability and validation gaps.