security: validate loginRedirect cookie to prevent open redirect

[kolega-ai-dev]

Vulnerability identified and fix provided by Kolega.dev

Open Redirect via loginRedirect Cookie

Location

server/controllers/auth.js:75-86 and client/components/login.vue:646-663

Description

The loginRedirect cookie value is read and used directly in res.redirect() (server-side) and window.location.replace() (client-side) without any validation. An attacker can set this cookie to an arbitrary external URL (e.g., https://evil.com), and when the victim authenticates, they will be redirected to the attacker-controlled site. This enables phishing attacks where the attacker's site mimics the legitimate application to steal credentials or session tokens.

While the server sets this cookie legitimately in common.js:446 using req.path (which should be a relative path), cookies can be set by JavaScript on the same domain, subdomains if cookie scope allows, or the user's browser directly.

Analysis Notes

This is a confirmed open redirect vulnerability with high practical exploitability. The loginRedirect cookie value is read at line 75 of auth.js and passed directly to res.redirect() at line 81 without validation. The same pattern exists in login.vue at line 652 with window.location.replace().

Fix Applied

Added validation to ensure the loginRedirect cookie value is a safe relative path before using it for redirection. The validation checks that the value starts with /, does not start with // (which would create a protocol-relative URL like //evil.com), and does not contain :// (which would allow absolute URLs like https://evil.com). If the cookie contains an invalid value, it is cleared and the redirect falls through to the default behavior (authResult.redirect or /). The same fix is applied to both the server-side callback handler and the client-side login response handler.

Tests/Linters Ran

• ESLint (node_modules/.bin/eslint --format codeframe server/controllers/auth.js client/components/login.vue): Passed with no errors or warnings
• pug-lint (node_modules/.bin/pug-lint server/views): Passed with no errors
• Jest (node_modules/.bin/jest): server/test/helpers/page.test.js passed (3/3 tests). The Cypress integration test suite (dev/cypress/integration/setup.spec.js) has pre-existing failures unrelated to this change (Cypress globals not available in Jest runner).

Contribution Notes

• Followed the project's existing code style (2-space indentation, single quotes, Standard JS conventions)
• Kept the fix minimal — only the two affected redirect locations were changed
• No new dependencies introduced
• The existing security.securityOpenRedirect middleware in server/middlewares/security.js only strips repeating slashes from req.url and does not protect against cookie-based open redirects

[NGPixel]

Thanks!