---
issue: 080
title: "Frontend: open redirect via unvalidated returnTo in GuestGuard"
severity: medium
domain: Authentication
labels: [security, frontend, open-redirect]
status: open
created: 2026-05-30
source: Full Codebase Audit 2026-05-30
---

# Frontend: open redirect via unvalidated returnTo in GuestGuard

**Severity:** medium
**Domain:** Authentication
**Labels:** security, frontend, open-redirect

## Description

`src/auth/guard/guest-guard.tsx:27` passes `returnTo` directly to `router.replace()` without validating that it is a same-origin relative path. An attacker can craft a link with `returnTo=//evil.com` or `returnTo=https://evil.com` to redirect users after login.

## Options

1. Allow only same-origin relative paths starting with a single `/` and not `//` — strict, safe default.
2. Allowlist of known internal path prefixes — safest but must be maintained.
3. Parse with `URL()` against `window.origin` and reject cross-origin — robust but slightly more code.

## Recommendation

Reject any `returnTo` that does not match `^/(?!/)` (single leading slash, not protocol-relative), else fall back to default landing route. One small helper, applied everywhere `returnTo` is consumed.

## Affected Files

- `frontend/src/auth/guard/guest-guard.tsx:27`
- Any other component that reads and acts on `returnTo`

## References

- [Full Codebase Audit 2026-05-30](../09%20-%20Audits/Full%20Codebase%20Audit%20-%202026-05-30.md) — DEC-2
