You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shiro.apache.org by "Allen-wick (via GitHub)" <gi...@apache.org> on 2026/06/11 03:35:30 UTC
[D] [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView [shiro]
GitHub user Allen-wick created a discussion: [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView
### Search before asking
- [x] I had searched in the [issues](https://github.com/apache/shiro/issues?q=is%3Aissue) and found no similar issues.
### Enhancement Request
Currently, WebUtils.issueRedirect() and RedirectView perform HTTP 302 redirects without validating the target URL against a whitelist or checking for protocol-relative URLs (e.g., //evil.com).
While I understand from the [Shiro Security Model](https://shiro.apache.org/security-model.html) that input validation is primarily the responsibility of the application developer, providing inherently unsafe redirect utilities often leads to Open Redirect vulnerabilities in downstream applications that rely on Shiro for post-login/post-logout flows.
### Describe the solution you'd like
I suggest introducing a "safe redirect" mechanism as a defense-in-depth measure. For example:
Add a WebUtils.issueSafeRedirect(request, response, targetUrl, allowedDomains) method.
Or introduce a SafeRedirectView that rejects absolute URLs not matching the current host or a configured whitelist, and blocks protocol-relative URLs (//).
If the URL fails validation, fallback to a default safe landing page (e.g., / or a configured default success URL).
I previously reported this via the security channel, and the security team advised opening a public issue for this hardening enhancement. I am happy to submit a Pull Request implementing this if the PMC agrees with the approach.
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
GitHub link: https://github.com/apache/shiro/discussions/2767
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
GitHub user lprimak added a comment to the discussion: [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView
Keep in mind that a lot of times, the request URI is not the same as the URI the backend sees.
This is because many times, backends run behind proxies on private networks.
This makes it particularly difficult to make whitelisting work in all cases, and keep them in sync with the proxy configuration
GitHub link: https://github.com/apache/shiro/discussions/2767#discussioncomment-17258304
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView [shiro]
Posted by "Allen-wick (via GitHub)" <gi...@apache.org>.
GitHub user Allen-wick closed a discussion: [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView
### Search before asking
- [x] I had searched in the [issues](https://github.com/apache/shiro/issues?q=is%3Aissue) and found no similar issues.
### Enhancement Request
Currently, WebUtils.issueRedirect() and RedirectView perform HTTP 302 redirects without validating the target URL against a whitelist or checking for protocol-relative URLs (e.g., //evil.com).
While I understand from the [Shiro Security Model](https://shiro.apache.org/security-model.html) that input validation is primarily the responsibility of the application developer, providing inherently unsafe redirect utilities often leads to Open Redirect vulnerabilities in downstream applications that rely on Shiro for post-login/post-logout flows.
### Describe the solution you'd like
I suggest introducing a "safe redirect" mechanism as a defense-in-depth measure. For example:
Add a WebUtils.issueSafeRedirect(request, response, targetUrl, allowedDomains) method.
Or introduce a SafeRedirectView that rejects absolute URLs not matching the current host or a configured whitelist, and blocks protocol-relative URLs (//).
If the URL fails validation, fallback to a default safe landing page (e.g., / or a configured default success URL).
I previously reported this via the security channel, and the security team advised opening a public issue for this hardening enhancement. I am happy to submit a Pull Request implementing this if the PMC agrees with the approach.
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
GitHub link: https://github.com/apache/shiro/discussions/2767
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView [shiro]
Posted by "Allen-wick (via GitHub)" <gi...@apache.org>.
GitHub user Allen-wick added a comment to the discussion: [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView
You are absolutely right — relying on `request.getServerName()` or attempting to parse `X-Forwarded-*` headers to build an "automatic" domain whitelist is extremely fragile in reverse-proxy environments and introduces its own trust boundary issues.
Given this architectural constraint, I would like to pivot the proposal to a narrower, **syntax-based defense-in-depth approach** that does not rely on inferring the current host.
Instead of automatic domain whitelisting, I propose enhancing `RedirectView` and `WebUtils` to block inherently dangerous redirect patterns at the syntax level:
1. **Block Dangerous Schemes**: Reject redirects targeting `javascript:`, `data:`, `vbscript:`, or `file:` schemes to prevent XSS via open redirect.
2. **Block Protocol-Relative URLs**: Reject URLs starting with `//` (e.g., `//evil.com/phishing`), which are a common vector for Open Redirects and bypass naive string-matching filters.
GitHub link: https://github.com/apache/shiro/discussions/2767#discussioncomment-17258305
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
GitHub user lprimak added a comment to the discussion: [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView
I am going to go ahead and move this to a discussion since I don't think this is straight-forward.
GitHub link: https://github.com/apache/shiro/discussions/2767#discussioncomment-17258307
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
GitHub user lprimak added a comment to the discussion: [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView
I am not so sure the above is the right approach either.
I can see legitimate redirects to different schemas, I can also see legitimate redirects to different domains, and protocol-relative URLs.
Not sure what can safely be done here without requiring complex configuration upfront or breaking compatibility...
GitHub link: https://github.com/apache/shiro/discussions/2767#discussioncomment-17258306
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
GitHub user lprimak added a comment to the discussion: [Enhancement] Add safe redirect utilities with domain whitelisting to WebUtils / RedirectView
Making as abandoned...
GitHub link: https://github.com/apache/shiro/discussions/2767#discussioncomment-17456207
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org