---
title: Unvalidated redirects
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Unvalidated redirects and forwards can occur on websites that redirect users to destinations obtained from untrusted external inputs.

A typical example of a vulnerability is a sign-in page that redirects users to a return URL specified by a query string parameter. Without sufficient protection, the following type of attack could occur:

1. An attacker creates a forged version of the site's sign-in page.
2. The attacker sends out links to the legitimate sign-in page with the forged page in the return URL parameter.\
   For example: _http://domain.com/SignIn?returnUrl=http://forgeddomain.com/SignIn_
3. A user clicks the link, signs in, and is redirected to the forged page.
4. The page informs the user that the authentication failed and requests another attempt to enter the sign-in credentials.
5. The user submits their authentication credentials on the forged page.
6. The page redirects the user back to the home page of the original site, where the user is already signed in.

An attacker could obtain the authentication credentials of users without them even noticing that an attack has occurred.

## Handling of redirects in Xperience

All redirects performed by default in Xperience are secured against unvalidated redirection attacks. For redirects that lead away from the website, the destination is automatically changed to the application root. If a redirect URL is set in the Xperience administration interface (a trusted source), no validation occurs and external URLs are allowed.

## Performing safe redirects

If your website has functionality or components that perform redirects, consider the possibility of unvalidated redirection attacks. Your code may contain security vulnerabilities if the redirect URL originates from an external input (such as a query string parameter or a posted form field).

The **safest approach** is to completely avoid redirects to URLs obtained from untrusted inputs.

If you cannot avoid such redirects, always use the [System.Web.MVC.UrlHelper.IsLocalUrl](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.urlhelper.islocalurl?view=aspnet-mvc-5.2) method to validate untrusted inputs before performing redirects.