fix: prevent open redirect via protocol-relative returnTo

[yogeshchoudhary147]

Summary

• defaultReturnTo in withAuthenticationRequired captured window.location.pathname verbatim, which equals //evil.com when a user visits https://app.example.com//evil.com
• Routers (react-router, next.js, gatsby) interpret a //-prefixed string as a protocol-relative URL, redirecting the user to an external host
• Fix normalizes the pathname to strip leading double slashes before storing it in appState.returnTo

Test plan

• New regression test: simulates a double-slash pathname and asserts loginWithRedirect receives a sanitized single-slash returnTo
• All existing tests pass
• 100% code coverage maintained

Summary by CodeRabbit

Bug Fixes

• Sanitized protocol-relative paths in authentication redirects to prevent unsafe redirect targets.
• Preserved valid paths and query strings when setting the post-authentication return location.

Tests

• Added coverage for paths beginning with double slashes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b4cdba46-cce7-47c4-a719-f074a53c9e43

📥 Commits

Reviewing files that changed from the base of the PR and between 8a23d7e and ff1c451.

📒 Files selected for processing (1)

• __tests__/with-authentication-required.test.tsx

🚧 Files skipped from review as they are similar to previous changes (1)

• tests/with-authentication-required.test.tsx

---

📝 Walkthrough

Walkthrough

The authentication redirect converts protocol-relative pathnames such as //evil.com to /evil.com before setting appState.returnTo. A test verifies this behavior.

Changes

Return path sanitization

Layer / File(s)	Summary
Sanitize and validate redirect return paths src/with-authentication-required.tsx, __tests__/with-authentication-required.test.tsx	defaultReturnTo normalizes leading double slashes in window.location.pathname. The authentication redirect test verifies that loginWithRedirect receives /evil.com as appState.returnTo.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main security fix for the protocol-relative open redirect vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/open-redirect-returnto

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@__tests__/with-authentication-required.test.tsx`:
- Around line 189-210: Update this test to save the original browser URL before
replacing it, then wrap the render and waitFor assertions in a try/finally block
that always restores the saved URL. Preserve the existing redirect expectations
while ensuring cleanup runs even when either operation fails.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 56f1c66c-5639-41e1-a0fd-0ba0567476eb

📥 Commits

Reviewing files that changed from the base of the PR and between 361c018 and d632900.

📒 Files selected for processing (2)

• __tests__/with-authentication-required.test.tsx
• src/with-authentication-required.tsx

[cschetan77]

This does fixes the open redirect via protocol relative urls but still see some concerns:

1. defaultOnRedirectCallback consumes returnTo as is.
2. Custom returnTo bypasses defaultReturnTo entirely.
3. Fallback in defaultOnRedirectCallback is also unsanitized.
4. Percent-encoded slash bypass - https://app.example.com/%2Fevil.com gives pathname = "/%2Fevil.com" which will still go though the regex defined unnoticed.

defaultOnRedirectCallback - the consumption point, where returnTo is actually acted on. It has zero sanitization regardless of where the value came from.

[yogeshchoudhary147]

Hey @cschetan77, went through all of them:

1. defaultOnRedirectCallback consumes as-is — value is already sanitized by defaultReturnTo before it even gets there, so //evil.com never reaches that point.

2. Custom returnTo bypasses sanitization — yeah this is true, but that's developer-controlled input, SDK can't own that. will add a docs note as follow-up.

3. Fallback unsanitized — fallback only runs when appState.returnTo is undefined, in our flow it's always set so this never executes.

4. Percent-encoded slash bypass — /%2Fevil.com stays on same origin, browser doesn't decode %2F to / during navigation. not a valid bypass.