Open Redirect in Adonisjs with Mutual Tls

An open redirect in Adonisjs with Mutual Transport Layer Security (mTLS) involves a server-side redirect that uses an untrusted client-supplied URL, while mTLS enforces client certificate authentication for inbound requests. The combination can create a misleading sense of trust: because mTLS authenticates the client, developers may assume the environment is fully controlled and overlook validation of redirect targets. In practice, mTLS protects the channel between client and server, but it does not prevent an authenticated client from supplying a malicious URL that the server then follows.

Consider an Adonisjs route that redirects based on a query or header value, for example:

Route.get('/dashboard', async ({ request, response }) => {
  const target = request.input('url');
  return response.redirect(target);
});

If the client possesses a valid mTLS certificate, the request reaches the server, but the server does not validate whether target is a safe, relative path or an external attacker-controlled URL. An authenticated client can supply https://evil.com, and the server will issue a 302 to that location. Because mTLS ensures the request comes from a known client, the developer might incorrectly assume the redirect is safe, but the vulnerability remains: the application is still reflecting or storing an uncontrolled destination.

Additionally, mTLS can complicate detection in testing environments. Security scanners that rely on unauthenticated probes may skip endpoints that require client certificates, assuming they are not publicly reachable. However, if an mTLS configuration is incorrectly set to accept optional or fallback certificates, or if client certificates are leaked or shared, the effective trust boundary expands. An attacker who obtains a valid client certificate can abuse the open redirect to phish users or chain the redirect with other infrastructure. The key takeaway is that mTLS secures the identity of the client, but it does not enforce safe handling of user-controlled redirect targets.

To remediate open redirect risks in Adonisjs when mTLS is in use, treat all external destinations as untrusted regardless of the strength of client authentication. Always validate and restrict redirect targets to a whitelist of allowed hosts or use server-side mappings that translate opaque tokens to predefined URLs. Never directly reflect a client-supplied URL into a redirect response.

Below is a secure pattern using relative paths and an allowlist:

const ALLOWED_HOSTS = ['app.example.com', 'dashboard.example.com'];

Route.get('/dashboard', async ({ request, response }) => {
  const target = request.input('url');
  if (!target) {
    return response.redirect('/home');
  }
  try {
    const url = new URL(target);
    if (!ALLOWED_HOSTS.includes(url.hostname)) {
      return response.redirect('/home');
    }
    // If you must allow external redirects, use a strict allowlist and log the event
    return response.redirect(url.toString());
  } catch (error) {
    return response.redirect('/home');
  }
});

This ensures that even when a request presents a valid client certificate, the application only redirects to known-safe destinations. For scenarios where you need to provide dynamic navigation, map internal identifiers to predefined routes instead of passing raw URLs:

Route.get('/go/:page', async ({ params, response }) => {
  const pages = {
    reports: 'https://app.example.com/reports',
    settings: 'https://dashboard.example.com/settings',
  };
  const destination = pages[params.page];
  if (!destination) {
    return response.redirect('/home');
  }
  return response.redirect(destination);
});

For mTLS-enabled Adonisjs servers, ensure your TLS configuration enforces client certificate validation consistently. Here is an example of server-side mTLS setup in Node.js using the https module, which you would integrate with your Adonisjs server bootstrap:

const fs = require('fs');
const https = require('https');
const { Ignitor } = require('@adonisjs/ignitor');

const serverOptions = {
  key: fs.readFileSync('path/to/server.key'),
  cert: fs.readFileSync('path/to/server.crt'),
  ca: fs.readFileSync('path/to/ca.crt'),
  requestCert: true,
  rejectUnauthorized: true,
};

https.createServer(serverOptions, (req, res) => {
  // Adonisjs bootstrapping via Ignitor
  new Ignitor(require('@adonisjs/fold')).appRoot(appRoot).handleHttp(req, res);
}).listen(443);

In this configuration, requestCert: true and rejectUnauthorized: true enforce that clients must present a certificate signed by the trusted CA. Combine this strict mTLS setup with validated redirects to eliminate open redirect risks. Remember that mTLS is a transport-layer control; application-level validation of destinations remains essential.