How to fix open redirect issue in java

Question

Currently my java code uses

response.sendRedirect(request.getRequestUrl().toString());

Which is an open redirect.

I have to fix this but I can not white list it since there are too many URL's are associated with it.

I have tried the following solution with ESAPI but it wont work for me.

ESAPI.httpUtilities().setCurrentHTTP(req, resp);
ESAPI.httpUtilities().sendRedirect(location);
ESAPI.httpUtilities().clearCurrent();

I am new to ESAPI.

Answer 1

[Disclaimer]

I'm project co-lead on ESAPI.

I have to fix this but I can not white list it since there are too many URL's are associated with it.

Essentially, "I have to fix the problem, but I am restricting myself from the easiest solution."

Here are the best practices enumerated by @jww:

1. Simply avoid using redirects and forwards.

2. If used, do not allow the url as user input for the destination. This can usually be done. In this case, you should have a method to validate URL.

3. If user input can’t be avoided, ensure that the supplied value is valid, appropriate for the application, and is authorized for the user.

4. It is recommended that any such destination input be mapped to a value, rather than the actual URL or portion of the URL, and that server side code translate this value to the target URL.

5. Sanitize input by creating a list of trusted URL's (lists of hosts or a regex).

6. Force all redirects to first go through a page notifying users that they are going off of your site, and have them click a link to confirm.

These are literally all the solutions available to you. Some web frameworks make this easy for you, like Spring MVC with Spring Security.

These lines:

 ESAPI.httpUtilities().setCurrentHTTP(req, resp);
 ESAPI.httpUtilities().sendRedirect(location);
 ESAPI.httpUtilities().clearCurrent();

Don't work because you have to inspect the user input before performing the redirect.