Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-013

Open redirect via res.redirect

mediumJavaScript / TypeScriptCWE-601CVSS 6.1

What it detects

Redirecting to user-controlled URLs without validation allows open redirect attacks.

How to fix

Validate redirect URLs against an allowlist of trusted destinations.

Vulnerable — Shield flags thislogin.js
const express = require("express");
const app = express();

app.get("/login/callback", (req, res) => {
  // ?returnUrl=https://evil.example turns this into a phishing hop
  res.redirect(req.query.returnUrl);
});
Fixed — scans cleanlogin.js
const express = require("express");
const app = express();

// Redirect only to fixed, trusted destinations
app.get("/login/callback", (req, res) => {
  switch (req.query.to) {
    case "billing": return res.redirect("/billing");
    case "team": return res.redirect("/team");
    default: return res.redirect("/dashboard");
  }
});

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-013, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-013: Open redirect via res.redirect — Zennoxa Shield