title: OWASP TOP10 - #10 Unvalidated Redirects and Forwards
body: <p>I read many of the articles to this topic, including the <a href="https://www.owasp.org/index.php/Top_10_2010-A10" rel="nofollow noreferrer">OWASP PAGE</a> and the <a href="http://googlewebmastercentral.blogspot.com/2009/01/open-redirect-urls-is-your-site-being.html" rel="nofollow noreferrer">Google blog article</a> about open redirects...<br>
  I also found this question on <a href="https://stackoverflow.com/questions/3445420/why-open-redirect-urls">open redirects here on stack overflow</a> but it's a different one</p>
  
  <p>I know why i should not redirect ... this makes totaly sense to me.</p>
  
  <p>But what I really don't understand: Where is exactly the difference between redirecting and putting this in a normal <code>&lt;a href</code> link?<br>
  Maybe some of the users are looking in the status bar but i think most of them are not really looking to the status bar, when they klick a link.<br>
  Is this really the only reason?
  like on this <a href="http://cwe.mitre.org/data/definitions/601.html" rel="nofollow noreferrer">article</a> they wrote:</p>
  
  <pre><code>&lt;a href="http://bank.example.com/redirect?url=http://attacker.example.net"&gt;Click here to log in&lt;/a&gt;
  </code></pre>
  
  <blockquote>
    <p>The user may assume that the link is safe since the URL starts with their trusted bank, bank.example.com. However, the user will then be redirected to the attacker's web site (attacker.example.net) which the attacker may have made to appear very similar to bank.example.com. The user may then unwittingly enter credentials into the attacker's web page and compromise their bank account. A Java servlet should never redirect a user to a URL without verifying that the redirect address is a trusted site.</p>
  </blockquote>
  
  <p>So, if you have something like a guestbook, where the user can put the link to their homepage, then the only difference is that the link is not redirected, but it still goes to the evil webpage.</p>
  
  <p>Am I seeing this problem right?</p>