fix(security): prevent open redirect on login redirect
Login redirect responses are followed without validating the target origin. An attacker who can influence the redirect URL could send users to a malicious domain. Add origin validation before following the redirect in both fetchApi() and getCsrfToken() — only follow if the redirect URL origin matches window.location.origin. Severity: Medium
Deimos AI committed
Feb 26, 2026 at 13:50 UTC
da24eb04e0f26fb4bf0bb5bac661f5cc6a4a5dba
1 file changed
+10
-4
webui/js/api.js
+10
-4
@@ -129,8 +129,11 @@ export async function fetchApi(url, request) {
129
csrfToken = null;
130
return await _wrap(false);
131
} else if (finalResponse.redirected && finalResponse.url.endsWith("/login")) {
132
- // redirect to login
133
- window.location.href = finalResponse.url;
132
+ // redirect to login (origin check prevents open redirect)
133
+ const _redirectUrl = new URL(finalResponse.url);
134
+ if (_redirectUrl.origin === window.location.origin) {
135
+ window.location.href = finalResponse.url;
136
+ }
137
return;
138
}
139
@@ -218,8 +221,11 @@ export async function getCsrfToken() {
221
}
222
223
if (response.redirected && response.url.endsWith("/login")) {
221
- // redirect to login
222
- window.location.href = response.url;
224
+ // redirect to login (origin check prevents open redirect)
225
+ const _redirectUrl = new URL(response.url);
226
+ if (_redirectUrl.origin === window.location.origin) {
227
+ window.location.href = response.url;
228
+ }
229
return;
230
}
231
const json = await response.json();