CGI redirect scripts: logging clicks and referrers before forwarding the browser

The mechanics of a CGI redirect

The critical detail is that HTTP redirects are entirely in the headers. A CGI script sends a Status header (or relies on the server to infer it from Location) and a Location header with the target URL, then exits without printing a body. The browser reads the status code, follows the Location, and loads the destination. Done correctly, the user sees only the final destination; the logging happens invisibly in between.

RealRefer, one of the original CGI products on this domain, used exactly this pattern to track referrer statistics for affiliate links and outbound clicks. The script received the destination identifier, logged the incoming referrer header, and redirected. This was the standard way to do affiliate click tracking before server-side analytics platforms existed.

Open redirect vulnerabilities

An open redirect is a redirect script that forwards the browser to any URL passed as a parameter, without restriction. Attackers use open redirects in phishing: they link to your trusted domain with a redirect parameter pointing to a malicious site. Because the link appears to go to your domain, email filters and users are more likely to trust it.

The fix is to validate the destination against an allowlist of permitted domains or paths before redirecting. If your script only needs to redirect to your own pages, validate that the destination starts with your own origin. If it must redirect to a fixed set of partner URLs, maintain an internal mapping from opaque IDs to destination URLs and never accept a raw URL as a redirect target from user input.

301 vs 302 and when to use each

A 301 Moved Permanently tells the browser and search engines that the destination URL is the permanent home of this resource. The browser caches the redirect, and search engines transfer link equity to the destination. Use 301 for permanent link aliases and for any URL you intend to keep pointing at the same place long term.

A 302 Found (or 307 Temporary Redirect) tells the browser the redirect is temporary and not to cache it. Use 302 for dynamic redirects where the destination changes per request (like a tracking link that could point anywhere), for A/B test routing, and for login redirects that send the user back to the page they were trying to visit. For click tracking, 302 is the correct choice because you do not want the browser to cache and bypass the tracking script on repeat visits.