Forum Discussion
OM
Nimbostratus
NimbostratusOpen Redirection Mitigation
hello, ASM has a feature to mitigate the open redirection attacks when the redirect happens at the header level (i.e: with Location in response). When the redirection is within the payload response...
Hi OM,
if this it the request: "https://website.com/redirect.jsp?url=https://google.com"
Then url is a parameter and https://google.com is a parameter value. In ASM you can control which parameter values are allowed. Issue solved.Sample config:
And the result:
KR
Daniel
Daniel_Wolf
MVP
MVPHi OM,
if this it the request: "https://website.com/redirect.jsp?url=https://google.com"
Then url is a parameter and https://google.com is a parameter value. In ASM you can control which parameter values are allowed. Issue solved.
Sample config:
And the result:
KR
Daniel
OMNimbostratus
NimbostratusThanks Daniel, that's what I did as a workaround.
The problem with that approach is, we don't have the full picture of what the website has as redirects and I try hard to avoid false positives....
I was hoping to have a built-in feature similar to open redirect in Location Header.
Anyways, I will keep an eye on the other redirects and eventualy refresh the list of parameters if another false positive pops up.
thanks.