Any forwards generated by your site should only be allowed to target specific locations. Ensure that any forward destination is an authorized location. Check all RequestDispatcher.forward(request, response);