`redirect`: Restrict Destinations
The redirect callback prevents unsafe open redirects. Allow relative URLs and same-origin absolute URLs, and fall back to the base URL for invalid or external URLs. Keep the default behavior if you do not need customization.
Safe redirect callback
callbacks: {
async redirect({ url, baseUrl }) {
if (url.startsWith("/")) return `${baseUrl}${url}`;
try {
if (new URL(url).origin === baseUrl) return url;
} catch {}
return baseUrl;
},
},💡 Do not return an arbitrary query-string URL.