Description

Ensure redirect rules configured on static sites only send visitors to URLs on domains the organization owns. Redirect rules should not point to unknown external domains or use patterns that let an attacker control the destination.

Rationale

A redirect to a domain you do not control can be abused for phishing, because the link starts on your trusted domain. Redirects to domains that have expired or changed owner are also risky. Limiting redirects to approved domains keeps visitors on sites you control.

Impact

  • Visitors are only redirected to domains you control

  • Prevents your site being used for phishing redirects

  • Some external redirects may need to be replaced with links

Default Value

By default, a static site has no redirect rules.

Pre-Requisites

  • Admin or Developer role on the static site

  • A list of approved domains

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the static site's Redirects/Rewrites page from the left pane and review the destination of each rule.

  4. If any rule redirects to a domain that is not approved, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the Redirects/Rewrites page.

  4. Edit each rule that points to an unapproved domain so it uses an approved destination, or delete it.

  5. Save the changes and test the redirects.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the Redirects/Rewrites page and restore the previous rule.

Reference