Note #010En anglais
Open redirects: why startsWith("/") is not enough
A "return to" parameter that only checks the first character can send your users to any site, from a link on your own domain. Why string checks fail, and the check that works.
27 septembre 2026 · 3 min de lecture