app/lib/return-to.mjs

Functions

Imports

It imports no other module of this repo. Imported by app/routes/theme.ts.

Source

1/**
2 * The `Referer` is attacker-supplied, so it is proven same-origin before the toggle redirects to it.
3 *
4 * @param {Request} request
5 * @returns {string}
6 */
7export function safeReturnTo(request) {
8  const referer = request.headers.get("referer");
9  if (!referer) return "/";
10  try {
11    const url = new URL(referer);
12    if (url.origin !== new URL(request.url).origin) return "/";
13    // `new URL("https://site//evil.com")` has pathname `//evil.com`, and `Location: //evil.com`
14    // is protocol-relative, resolving against another HOST. The origin check does not catch it.
15    if (url.pathname.startsWith("//")) return "/";
16    // `Referer` never carries a fragment (RFC 9110), so `url.hash` is empty for browser requests;
17    // it is echoed for callers that pass a URL from elsewhere.
18    return url.pathname + url.search + url.hash;
19  } catch {
20    return "/";
21  }
22}