{"record":{"id":"96b0ee3ea170bea7","repo":"toeverything/AFFiNE","slug":"blocked-redirect-to-untrusted-domain","errorCode":null,"errorMessage":"Blocked redirect to untrusted domain","messagePattern":"Blocked redirect to untrusted domain","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/frontend/core/src/desktop/pages/redirect/index.tsx","lineNumber":30,"sourceCode":"export const loader: LoaderFunction = async ({ request }) => {\n  const url = new URL(request.url);\n  const searchParams = url.searchParams;\n  const redirectUri = searchParams.get('redirect_uri');\n\n  if (!redirectUri) {\n    return { allow: false };\n  }\n\n  if (\n    isAllowedRedirectTarget(redirectUri, {\n      currentHostname: window.location.hostname,\n    })\n  ) {\n    location.href = redirectUri;\n    return { allow: true };\n  }\n\n  logger.warn('Blocked redirect to untrusted domain', redirectUri);\n  return { allow: false };\n};\n\nexport const Component = () => {\n  const { allow } = useLoaderData() as { allow: boolean };\n\n  if (allow) {\n    return null;\n  }\n\n  return <Navigate to=\"/404\" />;\n};\n","sourceCodeStart":12,"sourceCodeEnd":43,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/b4c8548c09da21b2898443559a5b846f0ccf5dd8/packages/frontend/core/src/desktop/pages/redirect/index.tsx#L12-L43","documentation":"Warning logged by the redirect page loader when `isAllowedRedirectTarget` rejects the requested `redirect_uri` — the target domain is not on the allowlist (or is the current host in a disallowed way), so navigation is refused and the page renders with allow:false. This is an open-redirect guard; the input at fault is an untrusted redirect_uri query parameter.","triggerScenarios":"Triggered when the desktop redirect page receives a redirectUri whose target fails the isAllowedRedirectTarget check, so navigation is refused.","commonSituations":"Occurs when an OAuth or deep-link flow attempts to redirect to an untrusted external domain. Use an allowed redirect target; the app stays on the current page otherwise.","solutions":["Only redirect to trusted, allow-listed domains.","Add the domain to the trusted list if legitimate."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b4c8548c09da21b2898443559a5b846f0ccf5dd8","analyzedAt":"2026-08-18T21:16:52.546Z","contentChangedAt":"2026-08-18T21:16:52.546Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}