Learn how flawed URL parsing causes Server-Side Request Forgery (SSRF), Open Redirects, and Parser Differential bypasses in modern web applications.
Frequently Asked Questions
Q1. Why is checking url.startsWith("https://example.com") vulnerable?
An attacker can register domains like https://example.com.attacker.com or https://example.com@attacker.com to easily bypass naive prefix checks.
Q2. What is a URL parser differential attack?
When a security gateway and a backend server use different URL parsing libraries, an attacker can craft a payload (e.g. using backslashes, double slashes, or null bytes) that the gateway considers safe but the backend executes maliciously.
Q3. How do I securely prevent Open Redirects in authentication flows?
Only allow relative path redirects (starting with a single / and not followed by another / or \), or validate the hostname against a strict whitelist of known company domains.