Open URL Redirect: What It Is and Which Controls Catch It
Robin Joseph
Senior Security Consultant
Last reviewed: September 2026.
A link that starts on your domain and ends on a phishing page is a trust problem, not just a technical one.
Open URL redirect is the vulnerability behind a very specific kind of phishing email: a link that looks like https://yourcompany.com/redirect?url=..., which is real, trusted, and safe, right up until the part after ?url= sends the click somewhere else entirely.
What Is an Open URL Redirect?
Lots of legitimate features redirect users somewhere: "log in, then return to the page you were on," referral links, marketing click-throughs. If the destination is taken from user input and never checked against an allowlist, an attacker can construct a link that starts on your real domain, passing every visual and technical trust check, and ends on a page they control.
That matters more than it sounds like it should, because people (and some email security tools) trust the domain of a link more than they check the destination. A redirect through your domain lends your credibility to whatever it points to next.
Which Controls This Maps To
| Framework | Control | What it requires |
|---|---|---|
| ISO 27001:2022 | A.8.26 (Application security requirements) | Redirect and URL-handling logic reviewed as a security-relevant feature, not just UX |
| ISO 27001:2022 | A.8.28 (Secure coding) | Input validation applied to any parameter that controls where a user is sent |
| ISO 27001:2022 | A.6.3 (Awareness, education and training) | Staff trained to recognize that a familiar domain in a link doesn't guarantee a safe destination |
What Auditors Actually Check
Auditors rarely test redirect logic directly, but they do look for evidence that your secure development lifecycle includes input validation as a standard step, and open redirects are one of the clearest, easiest-to-explain examples when demonstrating that process actually works. It's also relevant to phishing-simulation and awareness programs, since open redirects are a known building block of real phishing campaigns.
How to Prevent It
- Never redirect to a URL taken directly from user input, validate the destination against an explicit allowlist of known-safe paths or domains.
- If you must support external redirects (affiliate links, SSO callbacks), use a signed or server-generated token instead of a raw URL parameter.
- Log and monitor redirect endpoints for unusual destination patterns.
Frequently Asked Questions
Because the link visually starts on a trusted, real domain. That bypasses a lot of the instinctive and automated checks people and email filters rely on, the domain looks legitimate even though the destination isn't.
Usually rated medium severity by itself, but it's a common building block in phishing and OAuth token-theft attacks, which is why auditors and pentesters flag it even though it doesn't directly compromise data.
A.8.26 (Application security requirements) and A.8.28 (Secure coding) are the primary ones, the same controls that cover input validation generally.
Want to know where a gap like this would actually show up in your ISO 27001 or SOC 2 audit? Book a demo and we'll walk through it.