Zennoxa Shield
Rules / Go
SHIELD-GO-011

Open redirect via http.Redirect with user input

mediumGoCWE-601CVSS 6.1

What it detects

Redirecting to a user-controlled URL without validation enables open redirect.

How to fix

Validate redirect targets against an allowlist of permitted URLs.

Vulnerable — Shield flags thislogin.go
package web

import "net/http"

func LoginCallback(w http.ResponseWriter, r *http.Request) {
	// ?next=https://evil.example.com sends users to an attacker site
	http.Redirect(w, r, r.URL.Query().Get("next"), http.StatusFound)
}
Fixed — scans cleanlogin.go
package web

import "net/http"

var allowedRedirects = map[string]bool{
	"/dashboard": true,
	"/settings":  true,
}

func LoginCallback(w http.ResponseWriter, r *http.Request) {
	next := r.URL.Query().Get("next")
	if !allowedRedirects[next] {
		next = "/dashboard"
	}
	http.Redirect(w, r, next, http.StatusSeeOther)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-011: Open redirect via http.Redirect with user input — Zennoxa Shield