Secure Coding Guide

Secure Coding Guidelines
Security Considerations for Flow Design
Security Considerations for Session IDs
Secure Coding Cross Site Scripting
Secure Coding SQL Injection
Secure Coding Cross Site Request Forgery
Secure Coding Secure Communications
Storing Sensitive Data
Open Redirect Vulnerabilities
Protect Your App from Open Redirect Vulnerabilities
Authorization and Access Control
Lightning Security
Marketing Cloud Engagement API Integration Security
Secure Coding PostMessage
Secure Coding WebSockets
Platform Security FAQs
PDF

Open Redirect Vulnerabilities

Learn how to protect your app from open redirect vulnerabilities.

Understand Open Redirect Vulnerabilities

Apps that navigate or redirect without authenticating the destination are exposed to open redirect vulnerabilities. Attackers exploit this behavior to control and redirect users from a trusted Salesforce domain to a malicious external site, often as part of a phishing campaign, credential theft, or chained attack.

For example, if a user clicks https://your-org.salesforce.com/apex/MyPage?redirect=https://untrustedsiteexample.com, the user is silently redirected to an untrusted site.