URL Security Best Practices: Protect Links and User Data

Why URL Security Matters

URLs are visible in browser history, server logs, referrer headers, and analytics tools. Any sensitive data placed in a URL is exposed to anyone who can see those records. Session tokens, passwords, and personal IDs routinely leak through careless URL construction.

Security through URL design is not optional. A single leaked token in a shared link can compromise an entire account.

Never Put Secrets in the URL

What Counts as a Secret

Where to Put Them Instead

Use request headers or request bodies. Headers travel alongside the URL but are not logged in browser history or sent in referrer headers. Bodies are invisible to URLs entirely.

// Bad — token in query string
GET /api/user?token=abc123

// Good — token in Authorization header
GET /api/user
Authorization: Bearer abc123

Prevent Open Redirect Vulnerabilities

An open redirect occurs when your application takes a user-supplied URL and redirects to it without validation. Attackers use open redirects to trick users into visiting phishing sites that appear to come from your domain.

How to Fix It

1. Whitelist allowed redirect targets. Only allow paths or domains you control.
2. Use relative paths instead of full URLs. Redirect to /dashboard rather than https://evil.com.
3. Validate the destination. Parse the URL and check that the hostname matches your domain.

function safeRedirect(url) {
  const parsed = new URL(url, window.location.origin)
  if (parsed.hostname !== window.location.hostname) {
    return '/' // fallback to home
  }
  return parsed.pathname
}

Validate and Sanitize URL Input

Any URL component taken from user input — query parameters, path segments, fragments — must be validated before use.

Common Validation Rules

Path Traversal Example

// Dangerous — user controls the path
GET /files/../../../etc/passwd

// Fix — resolve and verify the path stays within the allowed directory
const resolved = path.resolve(baseDir, userInput)
if (!resolved.startsWith(baseDir)) throw new Error('Invalid path')

Enforce HTTPS Everywhere

HTTP URLs transmit data in plaintext.任何人 on the network can read and modify the traffic. HTTPS encrypts the connection and lets the browser verify the server's identity.

Steps to Enforce HTTPS

• Redirect all HTTP requests to HTTPS at the server level.
• Set the Strict-Transport-Security header to tell browsers to always use HTTPS.
• Use the Secure flag on cookies so they are never sent over HTTP.
• Submit your domain to the HSTS preload list for browser-level enforcement.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Be Careful with Referrer Headers

When a user clicks a link from your site, the browser sends a Referer header to the destination. This header includes the full URL of the originating page — including any query parameters.

How to Control Referrer Leakage

Use no-referrer on any page whose URLs contain session tokens or sensitive query parameters.

Secure URL Shorteners and Redirects

If you run a URL shortener or redirect service:

• Rate-limit redirect creation to prevent abuse.
• Show an interstitial page for flagged destinations so users know they are leaving your site.
• Log all redirects for abuse review.
• Scan destination URLs against phishing and malware databases.

Key Takeaways

• Never place session tokens, passwords, API keys, or PII in URLs — use headers or request bodies instead.
• Validate all user-supplied URL components and whitelist redirect targets.
• Enforce HTTPS with HSTS headers and the preload list.
• Control referrer leakage with meta tags or the Referrer-Policy header.
• Treat URL shorteners and redirect endpoints as high-risk surfaces that need rate limiting and logging.

Try It Yourself

Parse and inspect any URL for security issues with the URL Parser tool — check query parameters, hostname, and path segments at a glance.