While monitoring WAF logs, a security analyst discovers a successful attack against the following URL: Which of the following remediation steps should be taken to prevent this type of attack?

A blacklist is a reactive, easily bypassed control that cannot reliably enumerate all malicious redirect destinations an attacker might use.

Blocking URL redirections directly eliminates open redirect attacks by preventing the application from forwarding users to attacker-controlled external URLs via manipulated parameters. WAF rules configured to deny redirect parameters pointing to untrusted domains remove the attack vector entirely. This is the most targeted and effective remediation for open redirect vulnerabilities identified in WAF logs.

Double URL encoding is itself an attack evasion technique used to bypass filters and does not prevent open redirect exploitation.

Stopping all external calls from the application is an overly broad measure that would break legitimate functionality without specifically targeting the redirect vulnerability.