Open Redirect in Flask with Firestore

An Open Redirect in a Flask application that uses Firestore typically occurs when a route accepts a user-supplied URL or location parameter and then performs an HTTP redirect without strict validation. Firestore is often used to store configuration or feature flags, such as a list of allowed redirect targets or tenant-specific landing pages. If a Firestore document is used to look up a redirect destination and that value is passed directly to Flask’s redirect() or url_for() without validation, an attacker may supply a malicious external URL and cause victims to be redirected to phishing or malicious sites.

For example, a Flask route might read a redirect key from Firestore and use it to send users to a post-login page. If the stored redirect is user-controlled or not strictly constrained to same-origin paths, the route becomes an open redirect. Attackers can craft links like https://api.example.com/login?next=http://evil.example.com and, if the application blindly uses the Firestore value or the query parameter in a redirect, the victim’s browser is sent to the attacker’s domain, losing trust in the original domain.

When Firestore documents contain redirect URIs, ensure the values are restricted to known, relative paths or a strict allowlist of domains. Do not concatenate user input directly into redirect targets, and avoid using Firestore-stored URLs in security-critical redirects without server-side validation. The unauthenticated attack surface means that even without credentials, an attacker can probe endpoints that use Firestore-based redirect logic and attempt to manipulate the stored or supplied values.

middleBrick scans such unauthenticated surfaces and flags open redirect patterns by correlating input sources (query parameters, headers, Firestore-derived values) with redirect behavior, providing severity and remediation guidance in the report.

To remediate open redirect when using Firestore in Flask, validate and constrain redirect destinations on the server. Prefer relative paths for internal redirects and use a strict allowlist for external domains. Do not trust Firestore values or user input for the final redirect target without verification.

Example: Safe redirect with relative paths

Use Flask’s url_for to build internal-only redirects. This avoids external URLs entirely.

from flask import Flask, request, redirect, url_for

app = Flask(__name__)

@app.route('/login')
def login():
    # Simulate a safe next path derived from application logic, not user-controlled redirect URLs
    next_path = request.args.get('next', 'dashboard')
    # Only allow known relative endpoints; do not use raw external URLs
    allowed_endpoints = {'dashboard', 'profile', 'settings'}
    if next_path not in allowed_endpoints:
        next_path = 'dashboard'
    return redirect(url_for(next_path))

Example: Allowlist validation for external Firestore-stored URLs

If you must store redirect targets in Firestore, validate against an allowlist and resolve relative paths where possible.

from flask import Flask, redirect
from google.cloud import firestore

app = Flask(__name__)
db = firestore.Client()

ALLOWED_DOMAINS = {'https://app.example.com', 'https://app.example.com/consent'}

def get_redirect_url_from_firestore(doc_id: str):
    doc_ref = db.collection('redirects').document(doc_id)
    doc = doc_ref.get()
    if doc.exists:
        return doc.to_dict().get('url', '')
    return ''

@app.route('/consent')
def consent():
    doc_id = request.args.get('doc_id', 'default')
    target = get_redirect_url_from_firestore(doc_id)
    # Strict validation: only allow exact matches from the allowlist
    if target in ALLOWED_DOMAINS:
        return redirect(target)
    # Fallback to a safe internal route
    return redirect(url_for('default_consent'))

Additional hardening recommendations

• Never use raw Firestore document fields as redirect URLs without allowlist checks.
• Prefer server-side mapping: store route keys in Firestore and map them to internal url_for endpoints rather than storing full external URLs.
• Enforce relative paths for internal redirects and restrict external redirects to a small set of verified domains.
• Log suspicious redirect attempts for further review as part of your monitoring strategy.

These practices reduce the risk of open redirect vulnerabilities in Flask applications that rely on Firestore for configuration or routing data.