search

koajs / userauth

koa user auth middleware
MIT License
137 stars 18 forks source link

回跳URL中不允许包含/login #27

Closed ChenXuyang closed 6 years ago

ChenXuyang commented 7 years ago 
function formatReferer(ctx, pathname, rootPath) {
  var query = ctx.query;
  var referer = query.redirect || ctx.get('referer') || rootPath;
  if (referer[0] !== '/') {
    // ignore protocol://xxx/abc
    referer = rootPath;
  } else if (referer.indexOf(pathname) >= 0) {
    referer = rootPath;
  }
  return referer;
}

其中referer.indexOf(pathname) >= 0是否应该改为referer.startsWith(pathname)更加合适？ 因回跳的url中可能会包含/login字符串，这种情况会引起误判。

fengmk2 commented 6 years ago

I will fix this bug soon.