<init-param>
<param-name>allow.any.redirect.url</param-name>
<param-value>true</param-value>
</init-param>

public boolean allowedRedirectDestination(final String redirectUrl, final HttpServletRequest request)
    {
        // Test for total trust
        if (allowAnyUrl)
        {
            return true;
        }
        // Otherwise we use default behaviour: allow valid redirects to the same context.
        URI uri;
        try
        {
            // Attempt to parse the URI
            uri = new URI(redirectUrl);
        }
        catch (URISyntaxException e)
        {
            // Invalid URI - not allowed. This stops possible header injection attacks (see SER-127)
            // but it is also good in general that if we can't parse a URI, then we can't trust it.
            return false;
        }
        // The URI is valid - if it is absolute, then check that it is to the same context
        return !uri.isAbsolute() || RedirectUtils.sameContext(redirectUrl, request);
    }