SecurityHigh

Open Redirect in Callback

src/api/auth/callback.ts:64

What's going on

The OAuth callback forwards users to a URL provided in the query string without host validation, allowing phishing links that start on a trusted domain.

Why it matters

Open redirects trivially bypass a user's trust in the domain and are a standard stepping stone in credential phishing.

src/api/auth/callback.ts:64

Recommended Fix

Replace the inline query with a parameterized statement and validate the id before it ever reaches the database. A regression test is generated alongside the patch.

Before

1router.get("/callback", async (req, res) => {2  const session = await exchangeCode(req.query.code as string);3  const next = req.query.next as string;4  res.redirect(next || "/"); // attacker-controlled host5});

After

1const SAFE_ORIGINS = new Set(["https://snapcart.app"]);2 3router.get("/callback", async (req, res) => {4  const session = await exchangeCode(req.query.code as string);5  const requested = req.query.next as string;6  const next = requested && new URL(requested, "https://snapcart.app").origin7    === "https://snapcart.app"8    ? requested9    : "/";10  res.redirect(next);11});

Uploaddone
Analyzedone
Finddone
Explainactive
Fixupcoming
Testupcoming
Verifyupcoming