Function: safeReturnPath()
function safeReturnPath(raw: unknown, fallback?: string): string;
Defined in: me-client/src/return-path.ts:11 (opens in a new tab)
Where to send someone back to after they sign in or prove it is them again: a
path on your own site, or fallback. Refuses anything a browser would take
to another site (//evil.com, /\evil.com, a scheme), a backslash anywhere,
control characters (browsers drop some: /\t/evil.com becomes //evil.com),
a percent that does not decode, and dot segments, plain or percent-encoded,
which can collapse into //. sdk-py's
safe_return_path answers the same for every input in
test-vectors/return-path.json.
ParametersLink to this section
| Parameter | Type | Default |
|---|---|---|
raw | unknown | Default undefined |
fallback | string | Default '/' |
ReturnsLink to this section
string