CodePark/ questions / Links, redirects & tabnabbing
START PRACTICINGPRACTICE
Frontend question · Frontend security › Links, redirects & tabnabbing

Which returnTo value still sends the user to another site?

const returnTo = new URLSearchParams(location.search).get("returnTo") || "/";
if (returnTo.startsWith("/")) {
  location.assign(returnTo);
}
//evil.example/login

//evil.example/login is a protocol-relative URL. It starts with /, so it passes the check, but the browser reads it as https://evil.example/login. /\evil.example works too, because browsers treat a backslash like a slash in web URLs.

"/../evil.example" is the tempting wrong answer. The .. can't climb above the root, so it becomes /evil.example on your own site. The encoded %2F%2F stays inside the path. Fix it by parsing with new URL(returnTo, location.origin) and checking that the origin is your own.