Laravel Open Redirect: How to Validate Redirect URLs and Prevent Phishing Attacks

The Problem

How to Fix

1. 1

   Validate redirect URLs against an allowlist

   Never redirect to arbitrary user-supplied URLs:

   // DANGEROUS
   return redirect($request->input('redirect'));

   // SAFE — validate against your own domain
   $url = $request->input('redirect', '/');
   if (!Str::startsWith($url, '/') || Str::startsWith($url, '//')) {
       $url = '/';
   }
   return redirect($url);

   // SAFEST — use named routes
   $allowed = ['dashboard', 'profile', 'settings'];
   $route = $request->input('redirect', 'dashboard');
   if (!in_array($route, $allowed)) {
       $route = 'dashboard';
   }
   return redirect()->route($route);

2. 2

   Use Laravel's intended() for post-login redirects

   Laravel provides a built-in safe redirect mechanism for post-authentication flows:

   return redirect()->intended('/dashboard');

   This redirects to the URL the user originally requested (stored in the session by the auth middleware), falling back to /dashboard. Since the URL comes from the session (not user input), it cannot be manipulated by attackers.

3. 3

   Audit all redirect() calls that use request input

   Search your codebase for potentially unsafe redirects:

   grep -rn 'redirect(.*request\|redirect(.*\$_GET\|redirect(.*input' app/ routes/ --include='*.php'

   Also check for:
   - header('Location: ' . $userInput)
   - Response::redirectTo($userInput)
   - redirect()->away($userInput) — this explicitly bypasses domain validation

   Every occurrence needs validation.

How to Verify

curl -v 'https://yourapp.com/login?redirect=https://evil-site.com'

curl -v 'https://yourapp.com/login?redirect=//evil-site.com'

Prevention

Frequently Asked Questions