Open Redirect (ARCH9122)

Key swift.security.open-redirect · Severity warning · Category security · CWE CWE-601

Flags req.redirect(to:) / UIApplication.open with a target that comes from request or user data.

Incorrect

return req.redirect(to: req.query["next"] ?? "/")

Correct

let next = req.query[String.self, at: "next"]
guard allowed.contains(next) else { return req.redirect(to: "/") }

Fix

Allow-list redirect targets, or accept only relative paths.