Safe Redirect
A little gem to keep our Rails app safe from open redirection vulnerabilities.
Installation
Add this line to Gemfile.
gem 'safe_redirect'
Usage
Create a config/initializer/safe_redirect.rb file.
SafeRedirect.configure do |config|
config.default_path = 'https://www.yahoo.com' # default value: '/'
config.domain_whitelists = ['www.google.com'] # default value: []
config.log = Rails.env.development? # default value: false
end
We can also use wildcard subdomain on domain whitelists (thanks to Mike Campbell).
SafeRedirect.configure do |config|
config.domain_whitelists = ['*.foo.org'] # whitelisting foo.org, m.foo.org, www.foo.org, ...
end
Add this line to the controllers you wish to secure from open redirection.
include SafeRedirect
The redirect_to method provided by Rails will be overridden by safe_redirect's redirect_to method.
redirect_to 'https://www.google.com' # => redirects to https://www.google.com
redirect_to 'https://www.golgege.com' # => redirects to '/'
redirect_to 'https://www.golgege.com', safe: true # => redirects to 'https://www.golgege.com'
redirect_to 'https://www.golgege.com/hahaha' # => redirects to '/hahaha'
redirect_to 1234 # => redirects to https://www.yahoo.com as default path
Contributing
- Fork the repository
- Create a branch for a new feature or bug fix, build it
- Create a pull request
License
MIT License