Fix redirect target comes from the caller in Nuxt
The destination of a redirect is taken from the request without being checked. An attacker can send a link that starts with your domain and ends on theirs, which is what makes a phishing page credible - and in an OAuth callback it hands the authorisation code to whoever asked. Resolve the target against your own origin and refuse anything else.
medium likely Nuxt CWE-601 / OWASP A01:2021
The vulnerable pattern in Nuxt
This finding comes from the Nuxt fixture in the owlwarden test
suite, in GET /api/proxy.
The whole redirect target comes from the request, so a link to this endpoint can send a visitor anywhere. The URL they click genuinely belongs to you, which is what makes the page they land on convincing - and on an OAuth callback the authorisation code goes with them.
The corrected handler
Validate before sendRedirect(); getRequestURL(event).origin is the base.
const { next } = getQuery(event)
await sendRedirect(event, safeRedirect(next, getRequestURL(event).origin), 302)If you are not using Nuxt
Resolve the target against your own origin and refuse anything that lands elsewhere. Do not use a startsWith('/') check: '//evil.com' passes it and leaves the site.
Check your own repository
npx owlwarden scan
npx owlwarden explain open-redirectRuns on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.
Other Nuxt checks
Rules with a tested Nuxt example.
- cors-permissive medium Cross-origin policy accepts any origin
- hardcoded-secret high Credential hardcoded in source
- insecure-cookie medium Cookie set without its protective attributes
- install-lifecycle-script medium Package declares an install-time script
- security-headers-missing medium Security headers are not configured
- sensitive-data-logged medium Sensitive data written to a log
- sql-injection high SQL query built by string interpolation
- ssrf high Server fetches a URL the caller controls
- stack-trace-leak high Stack trace leaked in error response
- weak-crypto high Broken cryptographic primitive protecting a secret