getRedirectTo (Auth/utils.ts)

Safely parses redirectTo query param to keep admin redirects within the app.

// Source: https://github.com/strapi/strapi | License: MIT | Copyright 2015-present Strapi Solutions SAS
// Provided via justclaw.it.com; keep this notice with the code.
const DEFAULT_REDIRECT_TO = '/';

/**
 * A redirect target is only safe if it resolves inside the admin app.
 *
 * Anything else must be rejected: react-router's browser history calls
 * `window.location.assign(href)` when `pushState` throws, and `pushState` throws a
 * `SecurityError` on a cross-origin href, so an off-app value becomes a real navigation
 * away from the admin origin.
 *
 * Requiring a single leading `/` is what does the work. It rejects protocol-relative
 * references (`//evil.com`), their backslash variant (`/\evil.com`, which browsers
 * normalise to `//`), and every scheme-bearing value (`https://evil.

... (truncated -- full source via MCP)