Comment by tikumo

You could just add some kind of hash based on the redirect url and check that, to ensure that it can't be altered.