Skip to content

Commit 6d8eced

Browse files
committed
fix(login): Validate redirect path
1 parent 9668d68 commit 6d8eced

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

  • apps/juxtaposition-ui/src/services/juxt-web/routes/web

apps/juxtaposition-ui/src/services/juxt-web/routes/web/login.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,8 @@ router.post('/', async (req, res) => {
6565
res.cookie('access_token', login.accessToken, { domain: cookieDomain, maxAge: expiration });
6666
res.cookie('refresh_token', login.refreshToken, { domain: cookieDomain });
6767
res.cookie('token_type', 'Bearer', { domain: cookieDomain });
68-
res.redirect(redirect);
68+
69+
res.redirect(/^\/[^/.]/.test(redirect) ? redirect : '/');
6970
});
7071

7172
module.exports = router;

0 commit comments

Comments
 (0)