Glossary · Phase 8 · APIs
Open redirect
A page that sends visitors on to any address named in its link, which attackers use to make links to look-alike sites seem trustworthy.
A common extra is
/login?next=/settings, which returns people to the page they wanted. Only follownextif it's a path on your own site (it starts with a single/), or your login page becomes an open redirect that sends your users to a look-alike site after they sign in.
Try it now
Most account bugs are small choices like these. Each safe choice costs a line or two.
Learn it properly
Accounts and logins · Password hashing with bcrypt, sessions, pages that need a login, and safe logout. About 45 minutes.
Other terms from the same lesson
- session fixation: An attack where someone plants a session in your browser before you log in, then shares your signed-in session. Starting a fresh session at login stops it.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.