Open redirects in login flows built with coding agents
A next or redirect parameter that accepts any URL will send a signed-in user to a site you do not control. Allow only paths on your own origin.
Generated auth often reads a query parameter named next, redirect, or return_to, then sends the browser there after a magic link or a password check. That is convenient until the value is a URL on someone else's site. The visitor saw your domain on the way through and will trust the page that follows.
Accept a path, not a URL
- Allow a value that starts with a single slash, and reject a value that starts with // or /\.
- Reject a scheme such as https: and reject a backslash. Resolve the path against your own origin and check that the resulting host is yours before you set Location.
- When the parameter is missing or not on the allowlist, send the user to a fixed path such as /dashboard.
- OAuth redirect_uri values should be exact URLs you registered with the provider, not a copy of the query string.
Hiding the parameter does not close the redirect. If a later edit skips the check so a test can pass, the flow is open again. The safe behavior is the allowlist, including when the parameter is absent.