Search code examples
javasecurityesapi

How to fix open redirect issue in java

Currently my java code uses 

response.sendRedirect(request.getRequestUrl().toString());

Which is an open redirect.

I have to fix this but I can not white list it since there are too many URL's are associated with it.

I have tried the following solution with ESAPI but it wont work for me.

ESAPI.httpUtilities().setCurrentHTTP(req, resp);
ESAPI.httpUtilities().sendRedirect(location);
ESAPI.httpUtilities().clearCurrent();

I am new to ESAPI.

Solution

  • Thanks for all your suggestions and comments. I found that the lines

    ESAPI.httpUtilities().setCurrentHTTP(req, resp);
ESAPI.httpUtilities().sendRedirect(location);
ESAPI.httpUtilities().clearCurrent();

    Is now working fine for me, after a long struggle I found that my code is using latest version of commons-configuration.jar but when I added Esapi as a dependency the Esapi used an old version of the same and that was not compatible with my code so I just excluded the this from Esapi dependency using the exclusion in pom and it worked for me.