Function validateReturnToPath

internal/auth/auth.go:307–340

validateReturnToPath enforces the same-origin / known-prefix allow-list for return_to values. Accepting an arbitrary URL would turn /api/auth/login into an open redirector that an attacker could chain with phishing-class social engineering. Limiting to /oauth2/-prefixed server paths means the bounce

(raw string)

// the bounce can only land inside the OAuth flow we own (Slice 5b renamed the
// OAuth surface from /oauth2/* to /oauth2/*).
func validateReturnToPath(raw string) error {
	if !strings.HasPrefix(raw, "/oauth2/") {
		return errors.New("return_to must be a server path starting with /oauth2/")
	}
	if strings.ContainsAny(raw, "\\\n\r\x00") {
		return errors.New("return_to contains forbidden characters")
	}
	// url.Parse should produce a clean path-only URL: no scheme, no host.
	u, err := url.Parse(raw)
	if err != nil {
		return errors.New("return_to is not a valid URL path")
	}
	if u.Scheme != "" || u.Host != "" || u.User != nil {
		return errors.New("return_to must be a path with no scheme or authority")
	}
	// Reject path traversal that survives the HasPrefix check by being
	// collapsed by the browser. e.g. raw "/oauth2/../../dashboard"
	// matches the prefix but http.Redirect emits a Location header that
	// the browser resolves to "/dashboard" — escaping the allow-list.
	// path.Clean folds the "../" segments and we re-check the prefix on
	// the normalized form.
	cleaned := path.Clean(u.Path)
	if !strings.HasPrefix(cleaned, "/oauth2/") && cleaned != "/oauth2" {
		return errors.New("return_to escapes the allow-list after normalization")
	}
	// Also reject empty segments which a future router refactor might
	// treat as authority. "/oauth2//foo" survives path.Clean as
	// "/oauth2/foo" but the raw value carries the empty segment
	// which some HTTP stacks parse differently — fail closed.
	if strings.Contains(u.Path, "//") {
		return errors.New("return_to must not contain empty path segments")
	}
	return nil
}

// HandleCallback processes the Google OAuth callback and creates a session.
func (ua *UserAuth) HandleCallback(w http.ResponseWriter, r *http.Request) {