Redirect to a target from the request (open redirect)
Scan rule · RSC-SEC-145
- Security
- Severity: Medium
- CWE-601
- OWASP A01-2021
Finds redirects (`redirect`, `NextResponse.redirect`, `res.redirect`, `Location` header) to a parameter such as `next`, `redirectTo`, `returnTo` or `callbackUrl` without checking for a relative path or an allowlist — especially in OAuth callbacks.
Why this matters
Back to where the user came from after login: the callback carries a parameter like `?next=/account` for that. The older Supabase template for `/auth/callback` appends it unchecked to your own origin — `?next=@evil.example` turns into `https://your-app.com@evil.example`, and the browser ends up on a foreign host.
That is ideal for phishing: the link shows your real domain, the user sees your real login, and only then is sent on to the copy. `startsWith("/")` alone is not enough either when the target is used directly — `//evil.example` also starts with a slash.
Fix: accept the target only if it starts with exactly one `/` and contains no `//`, and append it to your own origin. For external targets keep a fixed list and compare `new URL(target).origin` against it.
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Allow only relative paths that start with exactly one “/” (not “//”) and append the target to your own origin — or check it against a list of allowed targets.