---
title: "Exploiting Unvalidated Redirects for XSS"
url: https://daily.dev/posts/exploiting-unvalidated-redirects-for-xss-qkw7sjhxj
source_url: https://dev.to/this-is-learning/exploiting-unvalidated-redirects-for-xss-ai
type: article
source: "This is Learning"
published: 2026-01-06T14:21:57.803Z
updated: 2026-01-06T14:22:22.498Z
tags: ["security", "javascript", "authentication", "angular", "web-security"]
reading_time: 10
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Exploiting Unvalidated Redirects for XSS

**[This is Learning](https://daily.dev/sources/til)** · 10 min read · 0 upvotes · 0 comments

## Summary

Unvalidated redirects in authentication flows can enable XSS attacks where malicious JavaScript is injected into redirect URLs. An attacker can craft a base64-encoded state parameter containing JavaScript code that executes during login, potentially stealing JWT tokens, localStorage data, and cookies. The vulnerability occurs when redirect URLs are not sanitized before being assigned to window.location.href. Mitigation strategies include implementing domain allowlists, using temporary authorization codes instead of passing tokens in URLs, validating redirect URLs against javascript: protocol, and detecting token reuse attempts.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://dev.to/this-is-learning/exploiting-unvalidated-redirects-for-xss-ai>

## Similar posts on daily.dev

- [Stealing JWT Tokens via OAuth redirect\_uri Manipulation: A Critical Vulnerability](https://daily.dev/posts/stealing-jwt-tokens-via-oauth-redirect-uri-manipulation-a-critical-vulnerability-hkk39e4wm) · InfoSec Write-ups · 6 upvotes · 1 comments
- [Reflected in the DOM, Escalated to Account Takeover](https://daily.dev/posts/reflected-in-the-dom-escalated-to-account-takeover-xvty7xgl6) · InfoSec Write-ups · 0 upvotes · 0 comments
- [Secure coding in JavaScript](https://daily.dev/posts/secure-coding-in-javascript-ih44s1aff) · Stack Overflow Blog · 5 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#authentication](https://daily.dev/tags/authentication), [#angular](https://daily.dev/tags/angular), [#web-security](https://daily.dev/tags/web-security)

[View this post on daily.dev](https://daily.dev/posts/exploiting-unvalidated-redirects-for-xss-qkw7sjhxj)