Moheeb Zara 92170e44f4 fix(auth): validate /auth/callback next param against open-redirect (D3) ...

next was appended to origin unvalidated; next=//evil.com or /\evil.com
redirected off-site post-login. Now only a same-origin absolute path
(single leading slash, no //, no /\) is honored, else /dashboard.

2026-05-18 18:31:06 -07:00

..

route.ts

fix(auth): validate /auth/callback next param against open-redirect (D3)

2026-05-18 18:31:06 -07:00