# open-redirect

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects redirects to user-controlled URLs that enable phishing and OAuth callback abuse. Use when writing code that redirects users to a URL from request parameters, form input, or any caller-controlled source. Also invoke when building login flows with "return to" URLs or OAuth callback redirects.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/open-redirect ~/.claude/skills/open-redirect
```

## From README

Open Redirect Security Check (CWE-601) What this checks Protects against open redirect vulnerabilities where an attacker crafts a link that redirects users from a trusted domain to a malicious site. Used in phishing campaigns to make malicious links appear legitimate, and in OAuth flows to steal authorization codes. Vulnerable patterns Redirect target read directly from a query parameter, form field, or request body and passed unchanged to the framework's redirect API. Client-side navigation (window.location and equivalents) assigned a value derived from the URL or form input with no validation. "Return to" or "next" parameters on login flows that accept any URL without an allowlist check. Validation that uses prefix or substring matching against the allowed host — allowed.com.evil.com passes a naive prefix check. Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/open-redirect/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars