# Open redirect scheme validation bypass

Redirect or navigation targets accepted without strict scheme and Unicode normalization checks

_Area: Web infrastructure and server-side requests. Seen in 4 disclosed reports; one confirmed bounty: $560; latest 2023-06-22. Updated 2026-10-23._

## How it works
A redirect or navigation target is taken from a header, parameter, or feed item and acted on after only a weak check. The check assumes the value is a normal http(s) URL, or that a deny-list of bad destinations will catch abuse. That assumption breaks when the value uses a scheme the check never considered (chrome:, javascript:) or Unicode characters the validator does not normalize but the eventual resolver does. The validator and the consumer parse the same string differently, so a value that looks safe to the check resolves somewhere else.

## Where it shows up
- Server-controlled headers (e.g. Onion-Location) passed to a navigation/open-URL call.
- Redirect parameters (redirect_after_login, opt-out actions) that feed a redirect chain.
- Feed/RSS item links rendered in privileged browser UI (new tab, news panels).
- Deny-list link validators that are black boxes with undocumented parsing.
- Unicode look-alikes such as Ideographic Full Stop (%E3%80%82) in hostnames.

## How to review
Find every place a URL from a header, param, or feed is opened or redirected. The invariant: the scheme must be checked against an allow-list (http/https only) at the point of navigation, and the host must be normalized (Unicode, trailing dots, percent-encoding) before any allow/deny decision. Confirm the same parser/normalizer is used by the validator and the consumer. For redirect chains, verify each hop re-validates rather than trusting the first hop.

## Variants seen
- Chained open redirects plus Unicode look-alike defeating a deny-list link validator [E1](https://bugbountylibrary.com/r/h1%3A1032610.md).
- Header-driven navigation accepting chrome:/javascript: schemes [E2](https://bugbountylibrary.com/r/h1%3A1089995.md).
- Feed item URLs navigated without scheme filtering into privileged pages [E3](https://bugbountylibrary.com/r/h1%3A1819668.md).

## Impact and severity
Led to posting forbidden-domain links [E1](https://bugbountylibrary.com/r/h1%3A1032610.md), reaching privileged chrome:// pages and restarting the browser [E2](https://bugbountylibrary.com/r/h1%3A1089995.md), and bypassing SOP to reach settings reset [E3](https://bugbountylibrary.com/r/h1%3A1819668.md). Severity rises when the sink is privileged browser UI or when the bypass defeats a security control (deny-list, SOP) rather than just redirecting.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1032610.md
- E2: https://bugbountylibrary.com/r/h1%3A1089995.md
- E3: https://bugbountylibrary.com/r/h1%3A1819668.md