Pentester criticises: Redirct Urls are not validated before redirect occurs

Hi - one of my projects just got pentested and the behavior of redirecting got mentioned as a medium issue:

The whitelist check is only applied when the email with the redirect link is generated. So it is possible to intercept the email, edit the GET route, change the base server address to a manipulated website, deliver the email, catch the token on the "wrongly" redirected website and with the stolen token take over the account.

Maybe change passwords_controller like:

          requested_redirect_url = @resource.build_auth_url(@redirect_url, redirect_headers)
          if DeviseTokenAuth::Url.whitelisted? requested_redirect_url
            redirect_to(requested_redirect_url)
          else
            render_edit_error
          end

Start by reviewing the redirect flow in passwords_controller, including build_auth_url, the whitelist check, redirect_to, and render_edit_error. Done means the redirect URL is validated before the redirect occurs and rejected URLs use the error path; verify the affected controller behavior with the repository’s relevant tests.