# Cwe 601 Open Redirect

> Use this skill when you need to remediate CWE-601 (URL Redirection to Untrusted Site (Open Redirect)) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing url redirection to untrusted site (open redirect) issues.

- Skill: `developerscoffee/cwe-601-open-redirect` (Agent Skill)
- Install (CLI): `npx skillmds@latest add developerscoffee/cwe-601-open-redirect`
- Raw SKILL.md: https://api.skillmd.com/api/skills/developerscoffee/cwe-601-open-redirect/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: DevelopersCoffee (https://skillmd.com/u/developerscoffee)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/developerscoffee/cwe-601-open-redirect

---


# CWE-601 URL Redirection to Untrusted Site (Open Redirect)

## Description

URL Redirection to Untrusted Site (Open Redirect)

Reference:
https://cwe.mitre.org/data/definitions/601.html


**OWASP Category**: A01:2021 – Broken Access Control


---

## Vulnerable Pattern


### ❌ Example 1

```java
    private ResponseEntity<?> getURLRedirectionResponseEntity(
            String urlToRedirect, Function<String, Boolean> validator) {
        MultiValueMap<String, String> headerParam = new HttpHeaders();
        if (validator.apply(urlToRedirect)) {
            headerParam.put(LOCATION_HEADER_KEY, new ArrayList<>());
            headerParam.get(LOCATION_HEADER_KEY).add(urlToRedirect);
            return new ResponseEntity<>(headerParam, HttpStatus.FOUND);
        }
        return new ResponseEntity<>(HttpStatus.OK);
    }
```




### ❌ Example 2

```java
    public ResponseEntity<?> getVulnerablePayloadLevel7(
            RequestEntity<String> requestEntity, @RequestParam(RETURN_TO) String urlToRedirect)
            throws MalformedURLException {
        MultiValueMap<String, String> headerParam = new HttpHeaders();
        URL requestUrl = new URL(requestEntity.getUrl().toString());
        headerParam.put(LOCATION_HEADER_KEY, new ArrayList<>());
        if (urlToRedirect.startsWith("/")) {
            urlToRedirect = urlToRedirect.substring(1);
        }
        headerParam
                .get(LOCATION_HEADER_KEY)
                .add(
                        requestUrl.getProtocol()
                                + "://"
                                + requestUrl.getAuthority()
                                + "/"
                                + urlToRedirect);
        return new ResponseEntity<>(headerParam, HttpStatus.FOUND);
    }
```





---

## Deterministic Fix



---

## Detection Pattern

Look for these patterns in your codebase:


```bash
# Find redirect operations
grep -rn "redirect:\|sendRedirect\|setHeader.*Location" --include="*.java"
```


```bash
# Find URL parameters
grep -rn "returnUrl\|redirectUrl\|callback\|next" --include="*.java"
```



---

## Remediation Steps


1. Validate redirect URLs against allowlist of permitted domains

2. Use relative URLs instead of absolute URLs

3. Map redirect targets to safe identifiers

4. Reject URLs with different host/protocol

5. Warn users before external redirects


---

## Key Imports

```java

import java.net.URL;

import java.net.URI;

import org.springframework.web.servlet.view.RedirectView;

```

---

## Verification

After remediation:


- Re-run SAST scan - CWE-601 should be resolved

- Test with external URLs: ?redirect=https://evil.com

- Verify only allowed destinations are permitted


---

## Trigger Examples

```
Fix CWE-601 vulnerability
Resolve URL Redirection to Untrusted Site (Open Redirect) issue
Secure this Java code against url redirection to untrusted site (open redirect)
SAST reports CWE-601
```

---

## Common Vulnerable Locations

| Layer | Files | Patterns |
|-------|-------|----------|

| Controller | `*Controller.java` | Login/logout redirects |

| Filter | `*Filter.java` | Auth redirects |

| Security | `*Handler.java` | Success/failure handlers |


---

## References


- [CWE-601: Open Redirect](https://cwe.mitre.org/data/definitions/601.html)

- [OWASP Unvalidated Redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)


---

**Source**: Generated by [Java CWE Security Skills Generator](https://github.com/DevelopersCoffee/java-cwe-security-skills)
**Last Updated**: 2026-03-07