codejump
MediumJavaScriptTypeScript

Prevent Open Redirect

Node.jsSecurity

The function below returns whatever URL the caller passes in, unchanged — the exact value a login page might feed straight into res.redirect().

The bug: an attacker can craft a link like https://codejump.io/login?next=https://evil.com and, after a successful login, the victim gets redirected to a phishing site that looks just like yours.

Your task: fix solve(redirectUrl) so that:

  • A relative path starting with a single `/` is returned unchanged (safe — stays on this site).
  • Anything else — an absolute URL, a javascript: URL, or a protocol-relative URL starting with // (a common bypass, since browsers treat it as same-protocol-different-host) — falls back to '/'.
solve('/dashboard')          // → '/dashboard'
solve('https://evil.com')    // → '/'
solve('//evil.com')          // → '/'   (protocol-relative bypass)
solve('javascript:alert(1)') // → '/'

Sample tests

Test #1Safe relative path — returned unchanged
Input: ["/dashboard"]
Output: "/dashboard"
Test #2Absolute external URL — blocked
Input: ["https://evil.com"]
Output: "/"
Test #3Protocol-relative URL — blocked
Input: ["//evil.com"]
Output: "/"
Test #4javascript: URL — blocked
Input: ["javascript:alert(1)"]
Output: "/"
← All challenges