Validierung des Ursprungs bei dynamischen Weiterleitungen in Route-Guards

import { createRouter, createWebHistory } from 'vue-router';
 
const allowedHosts = new Set(['app.example.com', 'auth.example.com']);
 
export const router = createRouter({
  history: createWebHistory(),
  routes: [
    {
      path: '/login',
      component: () => import('./views/LoginView.vue'),
      beforeEnter: (to) => {
        const target = to.query.redirect;
        if (typeof target !== 'string') return true;
 
        try {
          const url = new URL(target, window.location.origin);
          const isRelative = target.startsWith('/') && !target.startsWith('//');
          const isAllowedDomain = allowedHosts.has(url.hostname);
 
          if (!isRelative && !isAllowedDomain) {
            return { path: '/dashboard' };
          }
        } catch {
          return { path: '/dashboard' };
        }
        return true;
      }
    }
  ]
});