The application should ensure that the supplied value for a redirect
is permitted. This can be achieved by performing whitelisting on the
parameter value.

The whitelist should contain a list of pages or
sites that the application is permitted to redirect users to. If the
supplied value does not match any value in the whitelist then the
server should redirect to a standard error page.