node.js - Preventing Open Redirect in NodeJS -
i have set of node services, 1 of handles authentication. services redirect non-authenticated users login page on auth service, either setting property in request body or parameter in address can redirected after login. e.g.
https://mydomain.com:1234/auth/login?referer=https://mydomain.com:1235/usefulservice
after validating login, res.redirect(referer)
.
my question is, there simple way of checking open redirect isn't beingness abused?
https://mydomain.com:1234/auth/login?referer=http://www.evildoer.com/fake/usefulservice
i want users redirected services command - these have same ip / domain+subdomain, have different port numbers.
node.js security redirect express
No comments:
Post a Comment