Preventing Open Redirect Vulnerabilities

const express = require('express');
const app = express();

// Whitelisted domains for redirection
const ALLOWED_REDIRECT_DOMAINS = [
  'example.com',
  'www.example.com',
  'secure.example.com',
  'another-safe-domain.com'
];

// Middleware to validate redirect URLs
function validateRedirectUrl(req, res, next) {
  const redirectTo = req.query.next || req.body.next; // Common parameters for redirects

  if (redirectTo) {
    try {
      const redirectUrl = new URL(redirectTo);
      const redirectHostname = redirectUrl.hostname;

      // Check if the hostname is in the whitelist OR is the same origin
      if (ALLOWED_REDIRECT_DOMAINS.includes(redirectHostname) ||
          redirectHostname === req.hostname) { // Allow redirects to current host
        req.validatedRedirectTo = redirectTo;
        return next();
      }
    } catch (e) {
      // URL parsing failed, treat as invalid
    }
    console.warn(`Attempted invalid redirect to: ${redirectTo}`);
    return res.status(400).send('Invalid redirect URL.');
  }
  next(); // No redirect parameter, continue
}

app.use(validateRedirectUrl); // Apply the validation middleware globally or to specific routes

app.get('/login', (req, res) => {
  if (req.query.next) {
    // In a real app, authenticate user first. For demo, simulate successful login.
    if (req.validatedRedirectTo) {
      return res.redirect(req.validatedRedirectTo);
    } else {
      // Fallback to a default page if validation failed or no 'next' parameter
      return res.redirect('/dashboard');
    }
  }
  res.send('Login page. Try navigating to /login?next=https://example.com/profile');
});

app.get('/dashboard', (req, res) => {
  res.send('Welcome to the Dashboard!');
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});