Dave
ac201cb0a1
Auth gates redirected to a bare /login with no memory of where the user was headed, and the login page always sent them to /dashboard afterward — so opening the /m PWA while signed out landed you on the main dashboard instead of back on /m. Both gates now pass ?next=, and login honors it (falling back to /dashboard if missing/unsafe). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
9 lines
397 B
TypeScript
9 lines
397 B
TypeScript
/**
|
|
* Validates a `next` redirect target so login can send the user back
|
|
* to where they came from without opening a redirect to an external
|
|
* site (e.g. `?next=https://evil.example`). Only same-origin,
|
|
* root-relative paths are allowed.
|
|
*/
|
|
export function isSafeNextPath(path: string | null | undefined): path is string {
|
|
return !!path && path.startsWith("/") && !path.startsWith("//");
|
|
}
|