Open Redirect in Gorilla Mux with Firestore

An open redirect in a Gorilla Mux router occurs when a handler takes user-controlled input, such as a URL path parameter or query value, and uses it in an HTTP redirect without strict validation. In a Firestore-backed service, this risk is amplified because Firestore is often used to store configuration data such as allowed redirect targets, tenant mappings, or feature flags. If an application retrieves a redirect destination from Firestore and then passes an unvalidated user value into that flow, the combination can lead to insecure redirects that bypass intended allowlists.

Consider a multi-tenant API where each tenant has a configured post-login redirect URL stored in Firestore. A handler might read the tenant ID from the request, fetch the tenant document, and then redirect the user to a URL derived from a user-supplied next parameter. If the application uses the tenant document’s stored URL as a base but appends or substitutes user input without strict validation, an attacker can manipulate the parameter to point to a malicious site while the Firestore document gives the appearance of legitimacy.

Gorilla Mux routes typically capture variables like tenant_id or redirect_key. If the handler performs a Firestore lookup based on the route variable and then uses a user-controlled query parameter in the redirect without verifying that the final URL belongs to an approved set of domains, the application exposes an open redirect. This is especially dangerous when the Firestore rules permit broad read access, as the stored URL may be treated as trustworthy despite being user-influenced indirectly through the lookup path.

From a security checks perspective, middleBrick’s BOLA/IDOR and Input Validation scans would flag cases where redirect parameters are not strictly constrained, and the LLM/AI Security probes can detect logic flaws that allow an attacker to steer authentication flows to external domains. The presence of Firestore as a configuration store does not mitigate the need for strict allowlisting of redirect targets and careful handling of dynamic URLs in the handler logic.

Remediation focuses on ensuring that any redirect destination is strictly validated against an allowlist and never directly reflects user-controlled input. When using Firestore, treat stored URLs as templates or canonical domains rather than complete, user-controlled targets. Use Firestore to maintain a mapping of allowed redirect keys to base domains, and construct the final URL on the server side.

Example: a tenant-based redirect handler that safely resolves a Firestore-stored base domain and enforces a strict path prefix.

import (
	"context"
	"fmt"
	"net/http"
	"net/url"

	"cloud.google.com/go/firestore"
	"github.com/gorilla/mux"
)

type RedirectConfig struct {
	BaseDomain string `firestore:"base_domain"`
}

func redirectHandler(client *firestore.Client) mux.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		vars := mux.Vars(r)
		tenantKey := vars["tenant_key"]

		ctx := context.Background()
		doc, err := client.Collection("redirect_targets").Doc(tenantKey).Get(ctx)
		if err != nil {
			http.Error(w, "invalid tenant", http.StatusBadRequest)
			return
		}

		var config RedirectConfig
		if err := doc.DataTo(&config); err != nil {
			http.Error(w, "invalid configuration", http.StatusInternalServerError)
			return
		}

		// User-supplied path must be validated against allowed patterns
		suppliedPath := r.URL.Query().Get("path")
		if suppliedPath == "dashboard" || suppliedPath == "settings" {
			finalURL := &url.URL{
				Scheme: "https",
				Host:   config.BaseDomain,
				Path:   "/" + suppliedPath,
			}
			http.Redirect(w, r, finalURL.String(), http.StatusFound)
			return
		}

		http.Error(w, "invalid path", http.StatusBadRequest)
	}
}

In this pattern, Firestore stores only the base domain, preventing an attacker from poisoning the redirect target through document content. The handler validates the user-controlled path against an explicit allowlist before constructing the final URL. middleBrick’s OpenAPI/Swagger spec analysis can verify that the redirect endpoint does not echo raw user input into Location headers, while the Input Validation checks ensure that path constraints are correctly enforced.

For API keys or sensitive flows, you can extend the Firestore schema to include fingerprinted configuration versions and reject mismatches. Continuous monitoring via the Pro plan helps detect unexpected changes in stored redirect configurations that could weaken the allowlist over time.