OWASPASVS 5.0 requirement

ASVS-V3.7.2 The application will only automatically redirect the user to a different hostname or domain (which is not controlled by the application)…

L2 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V3 Web Frontend Security
Section: V3.7 Other Browser Security Considerations
Level: L2 (requirement applies from this verification level up)

Requirement

Verify that the application will only automatically redirect the user to a different hostname or domain (which is not controlled by the application) where the destination appears on an allowlist.