title: How to solve External Redirect attack-- from a Security Scan on the site
body: <p>So the Security Scan complained about External Redirect.</p>
  
  <p>I think it was bc this line in the code: 
    <code>header('location:'.$_POST['some_input']);</code>
  it was meant for some internal page jump, but could be abused by external url.<br>
  I have wrapped that in to a redirect function,
  basically it will add our url base to it </p>
  
  <pre><code>define('BASE_URL','https://example.com/');
  function redirect($url)
  {
      header('location:'.BASE_URL.$url)
  }
  </code></pre>
  
  <p>Then the above code become <code>$this-&gt;redirect($_POST['some_input'])</code></p>
  
  <p>I thought in this way, even an attacker make $_POST['some_input'] = 'attackersite.com', it would just redirect to a bad url. </p>
  
  <p>But then when i did the scan again it is exact same External Redirect complains. 
  Is it still not safe or the scanning software just doesn't care as long as they think you are doing the redirect?  If that is the only way to solve it is create a mapping of redirect URL? </p>
  
  <p><a href="http://i.stack.imgur.com/Lg0dt.png" rel="nofollow">OWASP ZAP REPORT</a></p>