Returns value when it is a safe same-origin path, otherwise fallback.
Accepted: a single leading /, no backslash, no scheme, no control character,
and at most MAX_RETURN_TO_BYTES bytes once non-ASCII characters are
percent-encoded (the returned value is the encoded form). Query strings and
fragments are allowed, since they stay on this origin.
The byte cap exists because the value is stored in the pending entry: on the
cookie strategy an unbounded path could push the session past its 4096-byte
budget, and the session plugin throws at commit — which would make the login
itself fail, not merely drop the redirect.
Parameters
value: string|undefined
The caller-supplied target, if any
fallback: string = '/'
What to use instead when value is unsafe; defaults to /
Returns
valuewhen it is a safe same-origin path, otherwisefallback.Accepted: a single leading
/, no backslash, no scheme, no control character, and at most MAX_RETURN_TO_BYTES bytes once non-ASCII characters are percent-encoded (the returned value is the encoded form). Query strings and fragments are allowed, since they stay on this origin.The byte cap exists because the value is stored in the pending entry: on the cookie strategy an unbounded path could push the session past its 4096-byte budget, and the session plugin throws at commit — which would make the login itself fail, not merely drop the redirect.