Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

StackOverflow bought the hyphenated site!


The URL will redirect to any URL in any domain.

share|improve this question
I don't understand – Andreas Bonini Jul 21 '10 at 18:08
Look at the URL.… This is a security hole. – SLaks Jul 21 '10 at 18:08
I did, but where is the URL from? You should specify it in your post – Andreas Bonini Jul 21 '10 at 18:09
@Kop: You can use this URL in social engineering attacks as a legitimate-looking URL that redirects to an evil site. – SLaks Jul 21 '10 at 18:11
I would re-write your post to better highlight the bug. – jjnguy Jul 21 '10 at 18:13
@SLaks: how can it possibly be "legitimate-looking" if it clearly states the return url? Google has security holes too then:… (and with google's it's harder to understand what it does) – Andreas Bonini Jul 21 '10 at 18:13
@Justin:​ Done. – SLaks Jul 21 '10 at 18:13
Ah, the memories...… – Shog9 Jul 21 '10 at 18:14
@Slaks, how can this be a security issue, besides sending people to harmful sites? – jjnguy Jul 21 '10 at 18:24
@Justin: It can be used in phishing emails as social engineering – SLaks Jul 21 '10 at 18:38
After the update, "StackOverflow bought the hyphenated site!" returns a blank page that says "true." – narawagames Jun 3 at 22:17
up vote 1 down vote accepted

The redirect here is now only valid for sites in our network, this change will go out in a build tonight, for example:



Invalid URLs (to any other domains) simply won't cause a redirect anymore.

share|improve this answer
hmmm, this still fails Open Redirect attacks,… – Luke Hutton Sep 8 '11 at 22:25

Imagine receiving this email (also, pretend you're dumb and likely to fall for phishing scams, but stay with me here):

To: Valued Stack Overflow user

From: Jeff Atwood,

Hey there, [blank]! We had a massive database failure, and unfortunately, our user database got all messed up. Thankfully, though, the fix is easy - all we need you to do is log in to the website. We've set up a special page to help make this repair easy, so please visit Stack Overflow account repair and sign in with your OpenID, and everything will be fixed for your account.

That "Stack Overflow account repair" page, which appears to reside on actually points to an evil phisher, who's site is Stack Underflow happens to look identical to Stack Overflow, and when you sign in, the nefarious owner of Stack Underflow is able to transfer all of your rep points to his account!! Nooooo!!!!

Will this particular scenario ever happen? No, but I think it illustrates a point - open redirects are something to think about, since even when I look at the url, it looks like it's at, unless I read all the way to the end and see the address.

To make this more evil, hover over the URL in Chrome! Chrome shows you the first portion of the URL, and after a second of hovering, then expands to show the whole URL. The URL is just long enough that it first displays this:


Chrome screenshot

share|improve this answer
Okay, when I wrote this, I just made up the address. I had no idea it is actually a website! Too bad it's broken. – Jared Harley Jul 21 '10 at 21:37
But that's the beauty of OpenID! The most they could get would be an auth token IF you reauthorized it. That's one of the reasons why you get directed to your OpenID site and authorize there! So even if you're on a phishing site the most they can get is your base open id url. :) – Joshua Jul 21 '10 at 21:43
I guess the best example against this is the Google example given in the comment above to the post. – Brian Jul 21 '10 at 22:27

This link better highlights the real security issue:

share|improve this answer
Not really. I can see youtube in the message text. It's worse when the URL is shortened - think, goatse trolling on /. – Shog9 Jul 21 '10 at 18:16
@Shog, see my edit – jjnguy Jul 21 '10 at 18:17
My vulnerability can be used in phishing emails with URL-encoding. Rickrolling posts can be fixed by moderators. – SLaks Jul 21 '10 at 18:22
@Slaks, I guess I don't see the difference. – jjnguy Jul 21 '10 at 18:25
@Justin: I think he's saying that users might trust a URL that appears to be from SO outside of SO more than they'd trust, say, a random obfuscated URL. – Shog9 Jul 21 '10 at 18:33
@Shog9: Exactly. – SLaks Jul 21 '10 at 18:46
@SLaks and @Shog, I get it. Thanks for clarifying. – jjnguy Jul 21 '10 at 19:12
Isn't this a problem with hyperlinks and HTML more than anything else? – Brian Jul 21 '10 at 20:31
@Changeling: no... There are plenty of problems caused by URLs that appear to go to one site and actually go to another, but this one requires cooperation from the apparent target in the form of a redirect to the actual target. Since SO isn't normally that kind of site, it's understandable that even savvy users might not expect it. – Shog9 Jul 21 '10 at 20:35
@Shog9: But if you look at the source of the hyperlink in this particular example (above answer), there is no redirect going on.. the text of the a href is the stackoverflow URL but the a href is actually youtube. I don't see how that is a redirect. Maybe you could explain further because I must be missing something.... – Brian Jul 21 '10 at 22:14
@Changeling: woops, I thought you were talking about SLaks' issue rather than jjnguy's. Yes, linking to one thing with text of another is a HTML thing - that's why most browsers display the actual URL in the status bar. – Shog9 Jul 21 '10 at 22:18
@Shog9: No problem :) Lost in translation – Brian Jul 22 '10 at 3:16
LOL that was funny – narawagames Jun 3 at 22:20

On any of the stack overflow sites it is pretty easy to disguise one url as another. Simply use the following syntax:


Displays as:

share|improve this answer
My vulnerability can be used in phishing emails with URL-encoding. – SLaks Jul 21 '10 at 18:21
Yes, true, but when I hover over the link, I can see it goes straight to your link. Hover over one of the evil links, and I see "". – Jared Harley Jul 21 '10 at 21:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .