Protect against open redirect vulnerabilities by following the security guidelines consistently across Visualforce, Aura, and Lightning Web Components.
Validate every redirected destination before navigation. Use multiple validation and security checks instead of relying on a single check.
Use only trusted destinations instead of trying to block malicious ones.
Use internal relative paths, such as /lightning/..., instead of full external URLs.
Treat values stored in the database as unreliable. Because database fields can be populated via APIs, imports, integrations, or user input, validate them before use.
Validate all inputs used for navigation, including URL parameters, @api properties, wire data, and page state. For example, a component can receive a URL through the Lightning Message Service and use it directly for navigation.
handleMessage(message) { window.location.href = message.redirectUrl;
Treat redirectUrl as untrusted input and validate it before navigation to prevent redirects to malicious external websites.
Don’t rely on NavigationMixin for URL safety, as it doesn’t validate destinations automatically, especially with standard__webPage.
Validate all data sources used for navigation or redirection, such as URL query parameters, database fields, @api component properties, user input fields, page state (CurrentPageReference), wire service data, Apex responses, and Lightning Message Service payloads.
Note
Secure your Visualforce pages by validating PageReference targets. Make sure that they point only to intended destinations and are validated. Don’t use query parameters directly in a PageReference as users can control them and these parameters can then be used to redirect to external URLs.
1// VULNERABLE
2public PageReference redirect() {
3 String url = ApexPages.currentPage().getParameters().get('redirectUrl');
4 return new PageReference(url);
5}Always validate database fields. If an attacker can influence stored values, the redirect destination becomes attacker controlled.
Note
1// VULNERABLE
2public PageReference redirect() {
3 Account acc = [
4 SELECT Redirect_URL__c
5 FROM Account
6 WHERE Id = :recordId
7 ];
8 return new PageReference(acc.Redirect_URL__c);
9}Restrict navigation to internal relative paths. Verify that the URL starts with a ’/’ character to reject external URLs before the redirect occurs. Here’s a secure PageReference validation.
1public PageReference redirect() {
2 String url = ApexPages.currentPage().getParameters().get('redirectUrl');
3
4 // Reject navigation if the URL is blank or not a relative path
5 if (String.isBlank(url) || !url.startsWith('/')) {
6 ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.ERROR, 'Invalid redirect URL.'));
7 return null;
8 }
9 return new PageReference(url);
10}Protect your Aura components from unauthorized window.location assignments. Avoid unvalidated attribute assignments because component attributes are influenced by external inputs and aren’t validated before use. These attributes give navigation control to attackers and can redirect users to malicious sites.
1window.location.href = component.get('v.redirectUrl');Verify that the destination is a relative URL before assignment. Verify that the URL starts with a ’/’ character to reject external URLs before the redirect occurs.
1// Enforce internal relative URLs
2if (url && url.startsWith('/')) {
3 window.location.href = url;
4} else {
5 // Display an error message or take corrective action
6}Rely on platform-managed routing in LWC to eliminate the risks associated with manual URL handling. Treat data from @api properties or CurrentPageReference.state as untrusted because it originates from external sources. Don’t use this data directly in a standard__webPage navigation type.
1//Vulnerable: Tainted @api Property Used for Navigation
2
3@api redirectUrl;
4
5this[NavigationMixin.Navigate]({
6 type: 'standard__webPage',
7 attributes: {
8 url: this.redirectUrl
9 }
10});Standard navigation types avoid direct URL handling entirely and rely on Salesforce platform-managed routing and access control. This eliminates the risk of open redirects caused by user-controlled URLs.
1// Preferred approach: Use platform-managed routing
2this[NavigationMixin.Navigate]({
3 type: 'standard__recordPage',
4 attributes: {
5 recordId: this.recordId,
6 objectApiName: 'Account',
7 actionName: 'view'
8 }
9});If you require relative URLs, use a regex allowlist to restrict navigation to known internal paths, such as /lightning/, /apex/, or /s/.
1const ALLOWED_URL_PATTERNS = [
2 /^\/lightning\//,
3 /^\/apex\//,
4 /^\/s\//
5];
6
7isValidInternalUrl(url) {
8 return url &&
9 url.startsWith('/') &&
10 ALLOWED_URL_PATTERNS.some(pattern => pattern.test(url));
11}Avoid using CurrentPageReference.state values from URL parameters as these values are controlled by users. Direct navigation with these values can cause open redirect vulnerabilities.
1const redirectUrl = this.currentPageReference.state?.redirect;Implement these secure coding patterns and tooling practices to eliminate open redirect vulnerabilities and protect your users.
To allow only internal Salesforce routes, restrict navigation to relative URLs.
1if (!url || !url.startsWith('/')) {
2 // Reject navigation
3 return;
4}Restrict navigation to specific internal paths or modules by using a regex allowlist. For example, allow only /lightning/, /apex/, or /s/ routes.
Eliminate attacker influence over the redirect destination by hard coding targets that don’t depend on user input.
Reduce open redirect risks by using platform-managed routing. Avoid standard__webPage whenever possible. Use standard types, such as standard__recordPage, standard__objectPage, and standard__navItemPage.
Secure your navigation by combining these validation layers:
Use static analysis tools, such as Salesforce Code Analyzer, as part of your security review process. Perform manual validation to confirm data flow and eliminate false positives.
Don’t rely on static analysis tools exclusively.
Note
j