Open redirects make phishing links look like yours

Many sites have a URL like /login?next=… or /out?url=… that sends the visitor somewhere after an action. If it accepts any address, an attacker can send a link that starts with your real domain and ends on their phishing page. People check the domain, see yours, and click.

Email filters often trust it too, because the domain is clean.

How to fix it in your code:

• Only allow relative paths that start with a single /, and reject // and backslashes.
• If you must redirect to other domains, keep an allowlist and check the parsed hostname exactly, not with “contains”.
• Better still, pass an ID (?next=billing) and map it to a URL on the server.
• Search your code and old marketing pages for redirect endpoints. Tracking links from old campaigns are a common leftover.