Safety
CSP base-uri vs Open Redirects on Public Sites
October 17, 2022
CSP base-uri vs open redirects on public sites is two different ways URLs get rewritten. base-uri in Content-Security-Policy limits which origins may appear in a <base href> (and the fallback document URL). An injected or leftover <base> can make relative links, forms, and some script src values resolve elsewhere. That is not the same as a server Location to a caller-chosen URL. form-action still belongs on HTML POSTs. RoastMyOpsec follows a bounded public redirect chain. It does not score missing base-uri, does not inject <base> tags, and does not treat base-uri 'none' as required to pass.
The practical difference
Relative URLs are resolved against the document base. A <base href='https://evil.example/'> on a page that still uses relative /login is a product bug CSP can blunt. An open redirect endpoint is origin code. CSP will not rewrite /redirect?next=.
base-uri 'none' or 'self' is a cheap default on marketing HTML that does not need <base>. Sites that use <base> for a CDN prefix must name that origin.
How to choose a policy
No <base> tag: base-uri 'none' or 'self'. You rely on <base> for a static prefix: allow only that HTTPS origin. Open redirects: allowlist destinations in the app, not in CSP. Pair with form-action 'self' so forms do not follow a hostile base either.
| Control | Stops | Does not stop | Takeaway |
|---|---|---|---|
| CSP base-uri | Unexpected document base | Server Location to a user URL | Cheap on brochure HTML |
| CSP form-action | Form POST to surprise origins | JS-driven fetch() | See form-action vs redirects |
| Open-redirect allowlist | Caller-chosen hops | A <base> in the HTML | Fix the endpoint |
| Referrer-Policy | Path leaks on navigation | The base URL itself | See URL leaks guide |
What the roast can prove
Public redirect hops can surface. Missing base-uri is not scored. Confirm the CSP string on HTML yourself. Pair with tokens in URLs if relative reset links still carry secrets.
Common mistakes
The first mistake is base-uri * because a CMS injects <base>.
The second mistake is treating base-uri as a WAF for /out.
The third mistake is base-uri 'self' on www while canonical is the apex.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does base-uri replace open-redirect fixes?
- No. It limits <base>. Redirect endpoints still need an allowlist.
- Should brochure sites set base-uri 'none'?
- Yes if you do not use <base>. Missing it is not a roast F.
- Does RoastMyOpsec score base-uri?
- No. It does not inject base tags. Open-redirect behavior on public hops is a separate check.