PHP login redirect security

Question

I wish to redirect users to the login page if they attempt to visit a page which requires them to be logged in. After logging in, however, I want to redirect the user back to their original destination. I've written a "redirect.php" script which is to be included on all such pages:

<?php
require "session.php";
if(!$user){
    header("Location: login.php?dest=".urlencode($_SERVER["REQUEST_URI"]));
    die();
}
?>

Then on my login page I have the following:

<?php 
$dest = "./";
if(isset($_GET["dest"])){
    $dest = $_GET["dest"];
}
?>

with the following JavaScript:

var URL = "<?php echo $dest; ?>";
//...
//upon successful login (via AJAX):
window.location.replace(URL);

Everything here works as intended but where does this stand from a security standpoint?

One vulnerability that comes to mind is something like

http://mysite.com/login.php?dest=http://phishingsite.com

How might I best prevent something like this? Would regex be suitable here?

Are there any other security concerns with this type of thing? Perhaps a standard way of doing this? Or better yet, a method which does not use GET variables at all?

Answer 1

The way you're doing it has advantages over a session based redirect because you have the ability to link people directly to that login with redirect URL.

The disadvantage is phishing as you pointed out.

http://www.mysite.com/login.php?dest=http://mysite.phishing.com/

The way you're doing this, using $_SERVER['REQUEST_URI'] means you expect the $_GET['dest'] to only include a path, not a domain.

So you could add a check in the login page where it sets the $dest

$dest = "./";
if(isset($_GET["dest"]))
{
    $parts = parse_url( $_GET['dest'] );

    // if there is no `host` key set in the parse_url array, then its an internal path
    // so set the new $dest
    if( !isset( $parts['host'] ) )
    {
        $dest = $_GET["dest"];
    }
}