security-review-owasp-unvalidated-redirects-and-forwards

To review code for unvalidated redirects and forwards, trace untrusted input values as they flow into redirect targets, forwards, and route selectors. Validate allowlists, canonicalization, and trust boundaries to confirm exploitability and downstream privilege impact.

An unvalidated forward vulnerability in login callback flows occurs when attacker-controlled input influences destination selection or privileged routing decisions. It allows unsafe navigation to attacker-specified destinations if allowlists and trust boundaries are not properly enforced.

Unvalidated redirects affect authentication and post-action navigation by accepting attacker-controlled destinations, bypassing trust boundaries. Reviewing object and parameter binding ensures that untrusted values cannot manipulate privileged routing decisions or downstream access controls.

Yes, you can use this security review approach for configuration and architecture files. The review evaluates unsafe redirect targets and forwarding logic across code, configuration, architecture, tests, and operational controls to identify exploitable routing vulnerabilities.

You need to check canonicalization and allowlists for redirect validation when untrusted input reaches redirectors or route selectors. Evidence-based validation of these controls is required before confirming a finding to accurately assess exploitability and trust boundary violations.

The best way to identify unsafe routing from untrusted input is to trace data flows into redirectors and forwards, then evaluate validation timing, allowlists, and parameter binding. Confirming exploitability requires assessing downstream privilege impact across affected flows.