OpenRedirect

[hcrix]

https://[domain]/login?next=https://google.com
does not work, but

https://[domain]/login?next=//google.com
works.

[gnestor]

@minrk @willingc Any ideas?

[willingc]

@gnestor I think since the second one is a protocol relative URL, it's taking the protocol (https) of the page. The first one is blocking the redirection. Probably makes sense to prevent redirect on the second as well.