Comparison
Deep linkvsOpen redirect
Deep link
someone pasted a URL from three screens in and it opened exactly that state, not the home page.
A URL that addresses a specific state inside the application directly. Supporting it means every meaningful state is reachable from its URL alone, which is what makes sharing, bookmarking and refreshing work. State kept only in memory — an open tab, a chosen filter, a modal — is invisible in the URL, and moving it there is usually the fix people describe as 'making it shareable'.
Full entry →Open redirect
the `?next=` parameter accepted an absolute URL and sent users straight off to another site after login.
A redirect target taken from user input without validation, letting an attacker use your trusted domain as the first hop of a phishing chain. It is also the classic way to leak a token in a fragment or a referrer to a destination you did not intend. The fix is an allowlist, or accepting only paths and rejecting anything with a scheme or a host.
Full entry →