isUrlLocal /3 (#35240)

* isUrlLocal /3

* isUrlLocal /3

* Update aspnetcore/security/preventing-open-redirects.md

Co-authored-by: Martin Costello <[email protected]>

---------

Co-authored-by: Martin Costello <[email protected]>

Author: Rick-Anderson

Diff for: aspnetcore/security/preventing-open-redirects.md

@@ -50,7 +50,7 @@ public IActionResult SomeAction(string redirectUrl)
 
 `LocalRedirect` will throw an exception if a non-local URL is specified. Otherwise, it behaves just like the `Redirect` method.
 
-### IsLocalUrl
+### IUrlHelper.IsLocalUrl
 
 Use the <xref:Microsoft.AspNetCore.Mvc.IUrlHelper.IsLocalUrl%2A> method to test URLs before redirecting:
 
@@ -70,4 +70,25 @@ private IActionResult RedirectToLocal(string returnUrl)
 }
 ```
 
-The `IsLocalUrl` method protects users from being inadvertently redirected to a malicious site. You can log the details of the URL that was provided when a non-local URL is supplied in a situation where you expected a local URL. Logging redirect URLs may help in diagnosing redirection attacks.
+The `IUrlHelper.IsLocalUrl` method protects users from being inadvertently redirected to a malicious site. You can log the details of the URL that was provided when a non-local URL is supplied in a situation where you expected a local URL. Logging redirect URLs may help in diagnosing redirection attacks.
+
+:::moniker range=">= aspnetcore-10.0"
+
+### Detect if URL is local using `RedirectHttpResult.IsLocalUrl`
+
+The [`RedirectHttpResult.IsLocalUrl(url)`](https://source.dot.net/#Microsoft.AspNetCore.Http.Results/RedirectHttpResult.cs,c0ece2e6266cb369) helper method detects if a URL is local. A URL is considered local if the following are true:
+
+* It doesn't have the [host](https://developer.mozilla.org/docs/Web/API/URL/host) or [authority](https://developer.mozilla.org/docs/Web/URI/Authority) section.
+* It has an [absolute path](https://developer.mozilla.org/docs/Learn_web_development/Howto/Web_mechanics/What_is_a_URL#absolute_urls_vs._relative_urls).
+
+URLs using [virtual paths](/previous-versions/aspnet/ms178116(v=vs.100)) `"~/"` are also local.
+
+`IsLocalUrl` is useful for validating URLs before redirecting to them to prevent [open redirection attacks](https://brightsec.com/blog/open-redirect-vulnerabilities/).
+
+```csharp
+if (RedirectHttpResult.IsLocalUrl(url))
+{
+    return Results.LocalRedirect(url);
+}
+
+:::moniker-end