checkRedirectTarget

Validates a redirect target and returns the string to put in Location, or the error that explains why it is not allowed.

Validates a redirect target and returns the string to put in Location, or the error that explains why it is not allowed. Allowed: a path on this site (/a, not //host and not /\\host), a path relative to the current URL, or an absolute http(s) URL of this origin or a trusted origin.

Import#

import { checkRedirectTarget } from "@shadow-js/dusk/server";

Signature#

function checkRedirectTarget(
  target: string,
  policy: RedirectPolicy,
): string | RedirectBlockedError

Parameters#

Name	Description
`target`	The target.
`policy`	Own origin and trusted origins.

Returns#

The target, or a RedirectBlockedError (returned, not thrown).

Examples#

checkRedirectTarget("//evil.test", policy) instanceof RedirectBlockedError; // true