HttpUtility.UrlEncode（）是否可以阻止Open Redirect攻击？

Question

I am checking a ASP.net MVC project for the security issues.

I found some code like the following, I am wondering is UrlEncode() preventing open redirect issue?

public ActionResult Redirect(string url)
{
   return Redirect(HttpUtility.UrlEncode(url));
}

Answer 1

No,Of course not!

Open Redirection is basically allowing an attacker to redirect a victim to an unsafe/malicious page because of a missing URL authentication.

Encoding the Url won't help.. At all.

To be able to prevent it you can see my answer on this thread:

https://stackoverflow.com/a/48051915/7827699