# Redirect scheme not allowlisted

Redirect params reaching Location, href or navigation sinks without a post-parse scheme allowlist

_Area: Web injection and code execution. Seen in 6 disclosed reports; 4 confirmed bounties, median $810, range $500-$5,000; latest 2023-07-01. Updated 2026-10-23._

## How it works
A redirect parameter is treated as a destination, but its scheme is never constrained. The raw value reaches a `Location` header, a link `href`, `window.location`, or a deep-link launcher. When the value is `javascript:` (or `data:`), the browser executes it in the redirecting site's origin, turning an open redirect into XSS. The broken assumption: "a redirect target is just a destination," when the scheme decides whether the browser navigates or executes. A related trust error appears when a host allowlist is checked but the scheme, or the content on that host, is not [E7](https://bugbountylibrary.com/r/h1%3A104087.md).

## Where it shows up
- Login/SSO `dest`, `redirect`, `continue` params used after authentication [E5](https://bugbountylibrary.com/r/h1%3A1962645.md)[E8](https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-01-21-admin-google-com-reflected-cross-site-scripting-xss.md)
- Endpoints that both set `Location` and render a fallback link, parsed differently [E2](https://bugbountylibrary.com/r/h1%3A260744.md)
- Params feeding a link `href` then read back by JS nav handlers [E3](https://bugbountylibrary.com/r/h1%3A874198.md)
- Regex URL validators with optional scheme groups, redirecting the raw string [E4](https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-02-03-google-com-mobile-feedback-url-redirect-regexvalidation-flaw.md)
- Host/origin checks done with the browser's own URL parser [E1](https://bugbountylibrary.com/r/h1%3A1238528.md)
- Middleware writing `request.params[:location]` straight to `Location` [E6](https://bugbountylibrary.com/r/h1%3A904059.md)

## How to review
List every navigation sink (Location header, `window.location`, link href, deep-link launch). For each, trace the value to input and confirm one invariant: the final scheme is explicitly allowlisted (http/https or relative-only) *after* parsing, and the parsed value—not the raw string—is used. Checklist:
- Regex validators make the scheme group mandatory and redirect on the parsed result [E4](https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-02-03-google-com-mobile-feedback-url-redirect-regexvalidation-flaw.md)
- Host/origin checks account for how each browser parses `javascript:` URLs [E1](https://bugbountylibrary.com/r/h1%3A1238528.md)
- Host allowlists confirm no allowed host serves user-controlled script [E7](https://bugbountylibrary.com/r/h1%3A104087.md)
- When two parsers exist (header vs. link), they agree on the same input [E2](https://bugbountylibrary.com/r/h1%3A260744.md)

## Variants seen
- `javascript:` accepted directly in SSO `dest`/`continue` params [E5](https://bugbountylibrary.com/r/h1%3A1962645.md)[E8](https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-01-21-admin-google-com-reflected-cross-site-scripting-xss.md)
- Location vs. rendered link parsed differently; `javascript:` runs in Firefox [E2](https://bugbountylibrary.com/r/h1%3A260744.md)
- LF injection defeating prefix checks, then trusted JSON `location` [E3](https://bugbountylibrary.com/r/h1%3A874198.md)
- Regex optional protocol group bypassed by a period before the colon [E4](https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-02-03-google-com-mobile-feedback-url-redirect-regexvalidation-flaw.md)
- Safari treats `javascript://host/...` as having a host, passing same-origin checks [E1](https://bugbountylibrary.com/r/h1%3A1238528.md)
- Host allowlist reopened via attacker-uploaded SVG on an allowed host [E7](https://bugbountylibrary.com/r/h1%3A104087.md)
- Unvalidated `location` in middleware [E6](https://bugbountylibrary.com/r/h1%3A904059.md)

## Why fixes fail
Host-only allowlists miss script-bearing content on allowed hosts [E7](https://bugbountylibrary.com/r/h1%3A104087.md); prefix checks fall to control characters [E3](https://bugbountylibrary.com/r/h1%3A874198.md); a CVE patch narrowed one condition while leaving a sibling sink open [E6](https://bugbountylibrary.com/r/h1%3A904059.md).

## Impact and severity
Reflected/DOM XSS and post-login script execution, enabling cookie/session theft [E5](https://bugbountylibrary.com/r/h1%3A1962645.md). Severity rises when the sink runs after authentication or on high-value SSO/admin domains [E8](https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-01-21-admin-google-com-reflected-cross-site-scripting-xss.md), and when chained to allowed-host content [E7](https://bugbountylibrary.com/r/h1%3A104087.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1238528.md
- E2: https://bugbountylibrary.com/r/h1%3A260744.md
- E3: https://bugbountylibrary.com/r/h1%3A874198.md
- E4: https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-02-03-google-com-mobile-feedback-url-redirect-regexvalidation-flaw.md
- E5: https://bugbountylibrary.com/r/h1%3A1962645.md
- E6: https://bugbountylibrary.com/r/h1%3A904059.md
- E7: https://bugbountylibrary.com/r/h1%3A104087.md
- E8: https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-01-21-admin-google-com-reflected-cross-site-scripting-xss.md