mediumAPI behaviour

Redirect Target Taken From the Request

The redirect destination comes straight from the request and is not limited to your own site.

Why it matters

A redirect that trusts the request lets a link that starts on your domain end up anywhere. Browsers and password managers show your domain first, so users trust the destination. Keeping redirects on your own site removes that problem entirely and costs one check.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Express redirect from query
app.get('/login/done', (req, res) => {
  res.redirect(req.query.next);
});

The smallest fix

minimal patch
// Only allow paths on this site:
const next = req.query.next;
const safe = typeof next === 'string' && next.startsWith('/') && !next.startsWith('//');
res.redirect(safe ? next : '/');

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// If you must support full URLs, compare the host to an allow-list:
const url = new URL(next, req.url);
const allowed = ['app.example.com', 'example.com'];
res.redirect(allowed.includes(url.hostname) ? url.toString() : '/');

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] the redirect target comes from the request: [the flagged code]. Only accept relative paths that start with a single "/" (reject "//" and anything with a scheme), or compare the hostname to a small allow-list, and fall back to "/" otherwise. Add a unit test for an external URL and a protocol-relative URL.

How to check the fix worked

1. Request the page with next=https://example.org and confirm you land
   on your own site, not example.org.
2. Request it with next=//example.org and confirm the same.
3. Request it with next=/dashboard and confirm the redirect works.

Further reading