Glossary
Open redirect
A URL on a trusted domain that will forward a visitor to any destination given to it, which attackers use to borrow that domain's reputation.
The pattern is a parameter like ?next= or ?url= that the server follows without checking. Because the visible domain is trusted, a filter or a person may wave the link through and land somewhere else entirely.
A link shortener is a redirect by design, which is why the domain a short link wears matters so much, and why generic shortener domains are treated with suspicion as a class.
The defence on your own service is to only ever redirect to destinations you stored yourself, never to one supplied in the request.
