{"id":12973,"date":"2025-02-20T01:45:14","date_gmt":"2025-02-19T22:45:14","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/"},"modified":"2025-02-20T01:45:14","modified_gmt":"2025-02-19T22:45:14","slug":"oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/","title":{"rendered":"OAuth 2.0&#8217;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti"},"content":{"rendered":"<p><body><\/p>\n<p>OAuth 2.0&#8217;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti<\/p>\n<p>OAuth 2.0, web uygulamalar\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc taraf servislerdeki kullan\u0131c\u0131 verilerine eri\u015fimini sa\u011flayan yayg\u0131n bir yetkilendirme protokol\u00fcd\u00fcr.  Ancak, bu protokol\u00fcn do\u011fru uygulanmamas\u0131 durumunda \u00f6nemli g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir.  Bu makalede, OAuth 2.0&#8217;\u0131n  <code>redirect_uri<\/code> parametresi \u00fczerindeki a\u00e7\u0131k y\u00f6nlendirme (open redirect) zafiyetini detayl\u0131 olarak ele alaca\u011f\u0131z.  Bu zafiyet, k\u00f6t\u00fc niyetli ki\u015filerin kullan\u0131c\u0131lar\u0131 zararl\u0131 web sitelerine y\u00f6nlendirmesine olanak tan\u0131r.<\/p>\n<h2>Zafiyetin Anla\u015f\u0131lmas\u0131<\/h2>\n<p>OAuth 2.0 ak\u0131\u015f\u0131 s\u0131ras\u0131nda, uygulama kullan\u0131c\u0131y\u0131 yetkilendirme sunucusuna y\u00f6nlendirir.  Kullan\u0131c\u0131 yetkilendirmeyi onaylad\u0131ktan sonra, sunucu uygulaman\u0131n belirtti\u011fi <code>redirect_uri<\/code> parametresine bir token ile birlikte bir y\u00f6nlendirme (redirect) ger\u00e7ekle\u015ftirir.  A\u00e7\u0131k y\u00f6nlendirme zafiyeti, bu <code>redirect_uri<\/code> parametresinin yeterince do\u011frulanmamas\u0131 durumunda ortaya \u00e7\u0131kar.  E\u011fer uygulama bu parametreyi do\u011frulamazsa, sald\u0131rgan kendi kontrol\u00fcnde olan bir URL&#8217;yi bu parametreye yerle\u015ftirip kullan\u0131c\u0131y\u0131 istedi\u011fi bir sayfaya y\u00f6nlendirebilir.<\/p>\n<p>\u00d6rne\u011fin, sald\u0131rgan, <code>redirect_uri<\/code> parametresine  <code>http:\/\/zararli-site.com<\/code> gibi bir URL yerle\u015ftirebilir. Kullan\u0131c\u0131 yetkilendirmeyi onaylad\u0131\u011f\u0131nda, do\u011frudan bu zararl\u0131 siteye y\u00f6nlendirilir.  Bu sayede sald\u0131rgan, phishing sald\u0131r\u0131lar\u0131 d\u00fczenleyebilir, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar indirebilir veya oturum \u00e7alma sald\u0131r\u0131lar\u0131 ger\u00e7ekle\u015ftirebilir.  Sonu\u00e7 olarak, kullan\u0131c\u0131 verileri ciddi risk alt\u0131na girer.<\/p>\n<h2>Zafiyetin Nas\u0131l \u00c7al\u0131\u015ft\u0131\u011f\u0131<\/h2>\n<p>Sald\u0131rgan\u0131n bu zafiyeti istismar etmesi olduk\u00e7a basittir.  OAuth 2.0 ak\u0131\u015f\u0131 s\u0131ras\u0131nda,  <code>redirect_uri<\/code> parametresi genellikle istekte g\u00f6nderilir.  E\u011fer uygulama bu parametreyi do\u011frulamadan kullan\u0131yorsa, sald\u0131rgan bu parametreyi kendi kontrol etti\u011fi bir URL ile de\u011fi\u015ftirebilir.  Bu durum, kullan\u0131c\u0131lar\u0131n kimlik bilgilerini \u00e7almak veya zararl\u0131 yaz\u0131l\u0131mlar indirmek i\u00e7in kullan\u0131labilecek sahte giri\u015f sayfalar\u0131na y\u00f6nlendirilmesine neden olur.<\/p>\n<p>Bu zafiyeti daha iyi anlamak i\u00e7in basit bir \u00f6rnek verelim:  Diyelim ki bir uygulama, OAuth 2.0 kullanarak kullan\u0131c\u0131lar\u0131n Google hesab\u0131na eri\u015fim sa\u011fl\u0131yor.  E\u011fer uygulama <code>redirect_uri<\/code> parametresini do\u011frulamazsa, bir sald\u0131rgan a\u015fa\u011f\u0131daki URL&#8217;yi kullanarak kullan\u0131c\u0131lar\u0131 zararl\u0131 bir siteye y\u00f6nlendirebilir:<\/p>\n<pre><code>https:\/\/accounts.google.com\/o\/oauth2\/v2\/auth?client_id=...&redirect_uri=http:\/\/zararli-site.com\/&response_type=code&scope=...<\/code><\/pre>\n<h2>Zafiyetten Korunma Yollar\u0131<\/h2>\n<p>Bu a\u00e7\u0131k y\u00f6nlendirme zafiyetinden korunmak i\u00e7in, uygulamalar <code>redirect_uri<\/code> parametresini dikkatlice do\u011frulamal\u0131d\u0131r.  \u0130\u015fte baz\u0131 temel \u00f6nlemler:<\/p>\n<ul>\n<li><strong>Beyaz Liste Kullan\u0131m\u0131:<\/strong> Uygulama, \u00f6nceden tan\u0131mlanm\u0131\u015f g\u00fcvenilir <code>redirect_uri<\/code> de\u011ferlerini bir beyaz listeye eklemeli ve yaln\u0131zca bu listedeki URL&#8217;leri kabul etmelidir.<\/li>\n<li><strong>URL Do\u011frulamas\u0131:<\/strong> Uygulama, <code>redirect_uri<\/code> parametresinin ge\u00e7erli bir URL olup olmad\u0131\u011f\u0131n\u0131 ve uygulaman\u0131n kontrol etti\u011fi bir alan ad\u0131 alt\u0131nda olup olmad\u0131\u011f\u0131n\u0131 do\u011frulamal\u0131d\u0131r.<\/li>\n<li><strong>HTTPS Zorunlulu\u011fu:<\/strong>  <code>redirect_uri<\/code> parametresi her zaman HTTPS \u00fczerinden iletilmelidir. Bu, g\u00fcvenlik a\u00e7\u0131\u011f\u0131 riskini azaltmaya yard\u0131mc\u0131 olur.<\/li>\n<li><strong>G\u00fcvenlik A\u00e7\u0131klar\u0131n\u0131 D\u00fczenli Olarak Tarama:<\/strong> Uygulamalar\u0131n\u0131z\u0131 d\u00fczenli olarak g\u00fcvenlik a\u00e7\u0131klar\u0131na kar\u015f\u0131 taramak, potansiyel sorunlar\u0131 erken a\u015famada tespit etmenize ve d\u00fczeltmenize yard\u0131mc\u0131 olur.  <a href=\"https:\/\/fatihsoysal.com\">Web sitemi<\/a> g\u00fcvenlik konusunda daha fazla bilgi i\u00e7in faydal\u0131 kaynaklar sunmaktad\u0131r.<\/li>\n<\/ul>\n<h2>Sonu\u00e7<\/h2>\n<p>OAuth 2.0&#8217;daki a\u00e7\u0131k y\u00f6nlendirme zafiyeti, kullan\u0131c\u0131lar\u0131n g\u00fcvenli\u011fini tehlikeye atan ciddi bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r.  Uygulamalar, <code>redirect_uri<\/code> parametresini do\u011fru bir \u015fekilde do\u011frulayarak ve yukar\u0131da belirtilen \u00f6nlemleri alarak bu zafiyetten korunmal\u0131d\u0131r.  G\u00fcvenli bir uygulama geli\u015ftirmek i\u00e7in, g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 \u00f6nlemek ve s\u00fcrekli g\u00fcvenlik denetimleri yapmak b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r.  Unutmay\u0131n, kullan\u0131c\u0131 verilerinin korunmas\u0131, g\u00fcvenilir bir uygulaman\u0131n temel ta\u015f\u0131d\u0131r.<\/p>\n<p>Bu konuda daha fazla bilgi edinmek i\u00e7in a\u015fa\u011f\u0131daki kaynaklara g\u00f6z atabilirsiniz:<\/p>\n<ul>\n<li><a href=\"https:\/\/owasp.org\/www-project-top-ten\/\">OWASP Top 10<\/a><\/li>\n<li><a href=\"https:\/\/dev.to\/blue_byte\/easy-bug-open-redirect-on-oauth-20-redirecturi-param-2h8f\">Orijinal Makale<\/a><\/li>\n<\/ul>\n<p>#Etiketler: OAuth 2.0, a\u00e7\u0131k y\u00f6nlendirme, open redirect, g\u00fcvenlik zafiyeti, redirect_uri, uygulama g\u00fcvenli\u011fi, web g\u00fcvenli\u011fi,  g\u00fcvenlik,  OAuth,  zafiyet,  korunma,  beyaz liste,  HTTPS<\/p>\n<p><\/body><br \/>\n<\/html><\/p>\n","protected":false},"excerpt":{"rendered":"OAuth 2.0&#8217;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti OAuth 2.0, web uygulamalar\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc taraf servislerdeki kullan\u0131c\u0131 verilerine eri\u015fimini sa\u011flayan&hellip;","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-12973","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>OAuth 2.0&#039;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti<\/title>\n<meta name=\"description\" content=\"OAuth 2.0, web uygulamalar\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc taraf servislerdeki kullan\u0131c\u0131 verilerine eri\u015fimini sa\u011flayan yayg\u0131n bir yetkilendirme protokol\u00fcd\u00fcr. Ancak, bu protokol\u00fcn do\u011fru uygulanmamas\u0131 durumunda \u00f6nemli g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Bu makalede, OAuth 2.0&#039;\u0131n redirect_uri parametresi \u00fczerindeki a\u00e7\u0131k y\u00f6nlendirme (open redirect) zafiyetini detayl\u0131 olarak ele alaca\u011f\u0131z. Bu zafiyet, k\u00f6t\u00fc niyetli ki\u015filerin kullan\u0131c\u0131lar\u0131 zararl\u0131 web sitelerine y\u00f6nlendirmesine olanak tan\u0131r.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OAuth 2.0&#039;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti\" \/>\n<meta property=\"og:description\" content=\"OAuth 2.0, web uygulamalar\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc taraf servislerdeki kullan\u0131c\u0131 verilerine eri\u015fimini sa\u011flayan yayg\u0131n bir yetkilendirme protokol\u00fcd\u00fcr. Ancak, bu protokol\u00fcn do\u011fru uygulanmamas\u0131 durumunda \u00f6nemli g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Bu makalede, OAuth 2.0&#039;\u0131n redirect_uri parametresi \u00fczerindeki a\u00e7\u0131k y\u00f6nlendirme (open redirect) zafiyetini detayl\u0131 olarak ele alaca\u011f\u0131z. Bu zafiyet, k\u00f6t\u00fc niyetli ki\u015filerin kullan\u0131c\u0131lar\u0131 zararl\u0131 web sitelerine y\u00f6nlendirmesine olanak tan\u0131r.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-02-19T22:45:14+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"OAuth 2.0&#8217;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti\",\"datePublished\":\"2025-02-19T22:45:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/\"},\"wordCount\":638,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/\",\"name\":\"OAuth 2.0'da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-02-19T22:45:14+00:00\",\"description\":\"OAuth 2.0, web uygulamalar\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc taraf servislerdeki kullan\u0131c\u0131 verilerine eri\u015fimini sa\u011flayan yayg\u0131n bir yetkilendirme protokol\u00fcd\u00fcr. Ancak, bu protokol\u00fcn do\u011fru uygulanmamas\u0131 durumunda \u00f6nemli g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Bu makalede, OAuth 2.0'\u0131n redirect_uri parametresi \u00fczerindeki a\u00e7\u0131k y\u00f6nlendirme (open redirect) zafiyetini detayl\u0131 olarak ele alaca\u011f\u0131z. Bu zafiyet, k\u00f6t\u00fc niyetli ki\u015filerin kullan\u0131c\u0131lar\u0131 zararl\u0131 web sitelerine y\u00f6nlendirmesine olanak tan\u0131r.\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OAuth 2.0&#8217;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"OAuth 2.0'da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti","description":"OAuth 2.0, web uygulamalar\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc taraf servislerdeki kullan\u0131c\u0131 verilerine eri\u015fimini sa\u011flayan yayg\u0131n bir yetkilendirme protokol\u00fcd\u00fcr. Ancak, bu protokol\u00fcn do\u011fru uygulanmamas\u0131 durumunda \u00f6nemli g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Bu makalede, OAuth 2.0'\u0131n redirect_uri parametresi \u00fczerindeki a\u00e7\u0131k y\u00f6nlendirme (open redirect) zafiyetini detayl\u0131 olarak ele alaca\u011f\u0131z. Bu zafiyet, k\u00f6t\u00fc niyetli ki\u015filerin kullan\u0131c\u0131lar\u0131 zararl\u0131 web sitelerine y\u00f6nlendirmesine olanak tan\u0131r.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/","og_locale":"tr_TR","og_type":"article","og_title":"OAuth 2.0'da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti","og_description":"OAuth 2.0, web uygulamalar\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc taraf servislerdeki kullan\u0131c\u0131 verilerine eri\u015fimini sa\u011flayan yayg\u0131n bir yetkilendirme protokol\u00fcd\u00fcr. Ancak, bu protokol\u00fcn do\u011fru uygulanmamas\u0131 durumunda \u00f6nemli g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Bu makalede, OAuth 2.0'\u0131n redirect_uri parametresi \u00fczerindeki a\u00e7\u0131k y\u00f6nlendirme (open redirect) zafiyetini detayl\u0131 olarak ele alaca\u011f\u0131z. Bu zafiyet, k\u00f6t\u00fc niyetli ki\u015filerin kullan\u0131c\u0131lar\u0131 zararl\u0131 web sitelerine y\u00f6nlendirmesine olanak tan\u0131r.","og_url":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-02-19T22:45:14+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"3 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"OAuth 2.0&#8217;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti","datePublished":"2025-02-19T22:45:14+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/"},"wordCount":638,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/","url":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/","name":"OAuth 2.0'da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-02-19T22:45:14+00:00","description":"OAuth 2.0, web uygulamalar\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc taraf servislerdeki kullan\u0131c\u0131 verilerine eri\u015fimini sa\u011flayan yayg\u0131n bir yetkilendirme protokol\u00fcd\u00fcr. Ancak, bu protokol\u00fcn do\u011fru uygulanmamas\u0131 durumunda \u00f6nemli g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Bu makalede, OAuth 2.0'\u0131n redirect_uri parametresi \u00fczerindeki a\u00e7\u0131k y\u00f6nlendirme (open redirect) zafiyetini detayl\u0131 olarak ele alaca\u011f\u0131z. Bu zafiyet, k\u00f6t\u00fc niyetli ki\u015filerin kullan\u0131c\u0131lar\u0131 zararl\u0131 web sitelerine y\u00f6nlendirmesine olanak tan\u0131r.","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/oauth-2-0da-acik-yonlendirme-open-redirect-zafiyeti\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"OAuth 2.0&#8217;da A\u00e7\u0131k Y\u00f6nlendirme (Open Redirect) Zafiyeti"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/12973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=12973"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/12973\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=12973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=12973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=12973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}