---
url: https://scruple.dev/rules/security/no-unsafe-redirect.md
description: Disallow request-controlled redirect targets.
---

# security/no-unsafe-redirect

Disallow request-controlled redirect targets.

## What it checks

Redirect only to fixed local paths or parsed URLs checked against an exact visible origin allowlist.

## Rule metadata

* Package: `@scruple/security`
* Category: Web security
* Tags: redirects, untrusted-input, allowlist
* Default threshold: `0.9`
* Minimum confidence: `0.75`

## Examples

### Reported

```ts
res.redirect(req.query.next);
```

### Accepted

```ts
const next = new URL(req.query.next, appOrigin); res.redirect(next.origin === appOrigin ? next.pathname : "/");
```