fix: only allow relative paths for callback URL query param

opengovsg / starter-kit

A technical kit to quickly build new products

https://start.open.gov.sg

MIT License

36 stars 6 forks source link

fix: only allow relative paths for callback URL query param #274

Closed christabelneo closed 6 months ago

christabelneo commented 6 months ago

Fixing a possible open redirect via URL parameter in the callbackUrl URL parameter that is appended to the URL when a redirect occurs due to the application session expiring (and receiving a 401 from the server)

vercel[bot] commented 6 months ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
starter-kit	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Feb 28, 2024 5:34am