Safe Redirect
Decide where a Location header may point when the target came from the request. An open redirect is a phishing primitive: an attacker sends a victim to a link on the real site and the site forwards them to one it does not control, carrying the trust of the first domain.
A target is answered unchanged only when it stays on this site, or names an origin or host the caller listed. Everything else answers the fallback, so a caller that forgets to check still sends the browser somewhere safe.
b.safeRedirect.resolve(rawTarget, opts?) #
{
base: string, // this site's URL; a target on its origin is allowed
allowedOrigins: string[], // origins allowed in full, compared lowercased
allowedHosts: string[], // hosts allowed on any port, compared lowercased
fallback: string, // where a refused target goes; default "/"
}Answer the URL a redirect may use, given the one the request asked for. A same-site target, meaning one that starts with /, ? or #, comes back unchanged. An absolute target comes back only when its origin matches base, or appears in allowedOrigins, or its host appears in allowedHosts. Anything else answers fallback.
A protocol-relative target such as //evil.example is treated as absolute and refused, and so is the backslash spelling browsers accept. A target carrying a control character, including a tab, is refused rather than trimmed, because a header splitting on one is a second bug.
Naming none of base, allowedOrigins or allowedHosts means no absolute target is allowed, so the off-site case stays closed until a caller opens it.
var b = require("@blamejs/core");
b.safeRedirect.resolve("/account", { base: "https://app.example" });
// → "/account"
b.safeRedirect.resolve("//evil.example/pay", { base: "https://app.example" });
// → "/"
b.safeRedirect.resolve("https://docs.example/start", {
base: "https://app.example", allowedHosts: ["docs.example"],
});
// → "https://docs.example/start"