Can anybody name all the risks of the following scenario:
User visits a page, but his session is expired, so he is auto-redirected to login page with his previous page and params added as a single parameter, encoded using PHP's urlencode()
:
https;//www.example.com/login.php?previous_page=%2Fdashboard.php
When logged in, autoredirect to:
https;//www.example.com/dashboard.php
I am currently aware of two:
- Manipulated links that contain external domain names, for example:
https://www.example.com/login.php?previous_page=http%3A%2F%2Fxss.com%2Fmalware.php
- Manipulated links that contain scripts, for example:
https://www.example.com/login.php?previous_page=%3Cscript%3Ealert(document.cookie)%3B%3C%2Fscript%3E
Currently preventing these by only accepting the value of previous_page
param if it starts with %2F
(encoded /
). Are there more risks to catch?