Note #010
Open redirects: why startsWith("/") is not enough
A "return to" parameter that only checks the first character can send your users to any site, from a link on your own domain. Why string checks fail, and the check that works.
27 September 2026 · 3 min read