fix: prevent open redirect after login

[tranquac]

Summary

Prevent open redirect after login by validating the redirect query parameter.

Problem

After successful authentication, the login handler redirects to the user-supplied redirect query parameter without validation:

res.redirect(req.query.redirect || '/controller');

An attacker can craft a login URL that redirects users to an external phishing site after they authenticate:

https://ztncui.example.com/login?redirect=https://evil.com/steal-session

Fix

Validate that the redirect URL is a relative path by rejecting URLs starting with // or containing ://:

let redirectUrl = req.query.redirect || '/controller';
if (redirectUrl.startsWith('//') || redirectUrl.includes('://')) {
    redirectUrl = '/controller';
}
res.redirect(redirectUrl);

Impact

• Type: Open Redirect (CWE-601)
• Affected endpoint: POST /login
• Risk: Post-authentication phishing, session theft
• OWASP: A01:2021 — Broken Access Control