Deprecate "back" magic string in redirects (#5935)

expressjs · Sep 11, 2024 · 77ada90 · 77ada90
1 parent 21df421
commit 77ada90
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/History.md b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+ * Deprecate `res.location("back")` and `res.redirect("back")` magic string
+
 4.20.0 / 2024-09-10
 ==========
  * deps: serve-static@0.16.0

diff --git a/lib/response.js b/lib/response.js
@@ -916,6 +916,7 @@ res.location = function location(url) {
 
  // "back" is an alias for the referrer
  if (url === 'back') {
+ deprecate('res.location("back"): use res.location(req.get("Referrer") || "/") and refer to https://dub.sh/security-redirect for best practices');
  loc = this.req.get('Referrer') || '/';
  } else {
  loc = String(url);