OpenRedirect
Open
component:Server
question
- Dominant language
- Jupyter Notebook
- Stars
- 13.3k
- Forks
- 5.8k
- Avg merge
- 6d 11h
- Merged PRs (30d)
- 7
Description
`https://[domain]/login?next=https://google.com`
does not work, but
`https://[domain]/login?next=//google.com `
works.
Contributor guide
Research direction
Start by reproducing the login URL with an absolute https://google.com target and with the protocol-relative //google.com target. Trace the login redirect handling and clarify the intended behavior for each form; done should include a regression test covering the agreed redirect behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- jupyter-notebook
- Domain
- authentication, backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100