Open redirect (ARCH6122)

Key ruby.security.open-redirect · Severity warning · Category security · CWE CWE-601

Taking a redirect target from untrusted input without validation lets attackers phish users by redirecting them to malicious sites through a trusted domain.

Incorrect

def login
  redirect_to params[:return_to]
end

Correct

def login
  redirect_to params[:return_to], allow_other_host: false
end

Fix

Redirect only to relative paths or origins on an allowlist; do not permit external targets.