The pattern to look for
Parameters named next, redirect, returnTo or url that are passed into a redirect call without checks.
Validate the target
function safeRedirect(target: string | null): string {
if (!target) return '/';
if (!target.startsWith('/') || target.startsWith('//')) return '/';
return target;
}Watch for tricks
- Protocol-relative URLs such as //other.example.
- Backslashes and encoded characters that browsers normalise.
- Look-alike hostnames that pass a naive contains check.
Frequently asked questions
Why is this a problem if it only redirects?
The link starts on your domain, so users and email filters trust it more, which helps phishing and token theft.