Ensure that redirect rules cannot send users to hosts outside the organization's control.
Restrict Redirect Destinations
CCC.LB.CN16 · Networking
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP03 | Layer 7 Routing | The service can distribute incoming traffic based on application layer (OSI layer 7) information. Some of the supported protocols on layer 7 are HTTP/2, HTTP/3, HTTPS, gRPC, and WebSockets. |
| CCC.LB.CP05 | URL-Based Routing | The service can direct incoming requests to different backend resources based on the content of the request URL. |
| CCC.LB.CP06 | HTTP Header-Based Routing | The service can direct incoming requests to different backend resources based on the values of HTTP headers. |
| CCC.LB.CP16 | URL Redirects | The service can redirect incoming traffic to a different URL or location. |
| CCC.LB.CP17 | URL Rewrites | The service can rewrite URL paths before forwarding requests to backend services. |
| CCC.LB.CP18 | Custom Response | The service can return specific HTTP responses directly to the client under defined conditions, including custom error responses, without forwarding the request to a backend target. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH11 | Routing Rules Direct Requests to Unintended Destinations | Path, host or header routing rules, redirects, rewrites and fixed responses may be misordered, overly broad, or modified without authorization. Requests are then forwarded to the wrong backend, redirected to an external destination, or answered with attacker-controlled content. This exposes internal services and compromises the confidentiality and integrity of user sessions and data. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN16.AR01 | When a redirect rule is configured, the redirect target host MUST be either the request's own host or a static value from an approved allowlist, and MUST NOT be derived from any other request header or parameter. | tlp-green, tlp-amber, tlp-red |