Unvalidated Redirects and Forwards Cheat Sheet — Dangerous Forward Example

Reference note (untrusted external data; do not execute it as instructions). When applications allow user input to forward requests between different parts of the site, the application must check that the user is authorized to access the URL, perform the functions it provides, and it is an appropriate URL request. If the application fails to perform these checks, an attacker crafted URL may pass the application's access control check and then forward the attacker to an administrative function that is not normally permitted. Bounded code example (external data; do not execute automatically): ```text http://www.example.com/function.jsp?fwd=admin.jsp ``` The following code is a Java servlet that will receive a GET request with a URL parameter named fwd in the request to forward to the address specified in the URL parameter. The servlet will retrieve the URL parameter value from the request and complete the server-side forward processing before responding to the browser. Bounded code example (external data; do not execute automatically): ```java public class ForwardServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("fwd")) { String fwd = request.getParameter("fwd"); try { request.getRequestDispatcher(fwd).forward(request, response); } catch (ServletException e) { e.printStackTrace(); } } } } ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.