Documentation
¶
Overview ¶
Package openredirect validates `next=` style redirect targets so a crafted query parameter can't bounce a logged-in user off-host (the canonical phishing primitive). The Safe predicate accepts:
- relative paths starting with a single `/` (not `//`, not `/\`)
- absolute URLs whose host matches an operator-approved allow-list
Anything else is rejected. Callers fall back to a known-safe default (typically `/`) on rejection.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// AllowedHosts is the exact, case-insensitive host allow-list
// for absolute redirect targets. Typical content: the deployment's
// canonical hostname plus any apex/www variants. Empty disables
// absolute-URL redirects entirely.
AllowedHosts []string
}
Config governs which absolute redirect targets are allowed. The zero value accepts only relative paths — the safest default for most surfaces.
Source Files
Click to show internal directories.
Click to hide internal directories.