Kolega.devandkolega.dev 7ae6635d16 fix: validate loginRedirect cookie to prevent open redirect (#7923) ...

The loginRedirect cookie value was used directly in res.redirect() and
window.location.replace() without validation, allowing redirection to
arbitrary external URLs. Added validation to ensure the redirect target
is a relative path before use.

Co-authored-by: kolega.dev <faizan@kolega.ai>

2026-02-11 21:27:36 -05:00

..

auth.js

fix: validate loginRedirect cookie to prevent open redirect (#7923)

2026-02-11 21:27:36 -05:00

common.js

fix: Add missing status code on unauthorized access (#7785)

2025-09-24 00:06:37 -04:00

ssl.js

fix: remove duplicate query parameters on HTTPS redirect (#6460)

2023-06-03 23:19:01 -04:00

upload.js

fix: disallow # char in file uploads (#3770)

2021-05-20 15:16:26 -04:00