The Redirect That Left the Building

Phishing reports mention a login URL that ends on a lookalike domain. Marketing uses next for post-login bounce. The validator only rejects javascript: schemes and never checks the host against the allowlist.

Initial failing signalexternal next URL acceptedExpected behavior: An external next URL falls back to /dashboard. · actual behavior: The external next URL redirects to https://evil.example/phish.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Call safe_next with https://evil.example/phish.
Expect the configured fallback path.
Relative paths under the app should still work.

Focus Mode

Start

src/redirects.py
src/login.py

Likely area

src/redirects.py
src/login.py
src/allowlist.py

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecurity

DifficultyMedium

Est. time15 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace