https://github.com/trendyol/safe-redirect
library which resolves open-redirection vulnerability when we need to make redirection to a path taken from query string.
https://github.com/trendyol/safe-redirect
Last synced: 7 months ago
JSON representation
library which resolves open-redirection vulnerability when we need to make redirection to a path taken from query string.
- Host: GitHub
- URL: https://github.com/trendyol/safe-redirect
- Owner: Trendyol
- License: mit
- Created: 2020-06-26T12:44:30.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2025-02-03T11:17:37.000Z (12 months ago)
- Last Synced: 2025-03-22T05:33:02.318Z (10 months ago)
- Language: TypeScript
- Homepage:
- Size: 376 KB
- Stars: 15
- Watchers: 7
- Forks: 1
- Open Issues: 16
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# safe-redirect
safe-redirect is a library which resolves open-redirection vulnerability when we need to make client-side redirection to a path taken from query string.
## Example
For example, we have `/login` page and after successful login we need to redirect user to a path. Referrer can state the redirection path using `callback` query string parameter. Url looks like:
`https://domain.com/login?callback=/payment`
In `/login` page, after successful login, we implement the aforementioned requirement in this way:
```
// successful login
const path = new URLSearchParams(window.location.search).get("callback");
window.location.assign(path);
```
And here we have a __open-redirection vulnerability__
#### Case 1
`https://fake.com` can redirect user to `domain.com/login?callback=https://fake.com/fake` , after successful login, the user will be redirected to `https://fake.com/fake`.
#### Case 2
A site can redirect user to `domain.com/login?callback=javascript:alert(document.cookie)` and execute custom javascript code. (sensitive user data can be stolen, etc).
#### Solution
safe-redirect library solves this vulnerability. Simply:
`npm i @trendyol-js/safe-redirect`
```
import { redirect } from "@trendyol-js/safe-redirect";
// successful login
redirect("callback"); // give name of the query parameter
```
---
##### Feel free to contribute