🛡️ Free practice test question from: DOM for Open Redirect Attack (Security+)

The vulnerability arises because the client-side JavaScript uses unvalidated user input from the redirect parameter to change window.location, leading to a DOM-based open redirect.

A) Suggests validating the redirect parameter in JavaScript. However, client-side validation can be bypassed by attackers manipulating the code in their browsers, so this is not sufficient on its own.

B) Proposes encrypting the redirect parameter. While encryption can prevent tampering, it introduces complexity and still relies on the client to handle sensitive data, which can be insecure.

C) Is correct because moving the redirection logic to the server side allows the application to securely validate the redirect parameter against a whitelist of trusted URLs or domains before performing the redirect. Server-side validation is more secure as it cannot be bypassed by client-side manipulation.

D) Suggests using the HTTP Referer header, but this header can be manipulated or omitted by clients and proxies, making it unreliable for security purposes.