fix(router): same-origin redirects by default on PE/full-page paths + redirect({ external: true }) opt-in (#572) - #580

Problem

Rango already blocks cross-origin redirect targets on the JS/fetch path: validateRedirectOrigin runs in the navigation/partial/action bridges, so a redirect("https://evil.example") triggered from a client-driven action or navigation is dropped and the user stays put. But that guard only runs where Rango's own JS decides to navigate. A redirect the browser follows natively — a no-JS progressive-enhancement (PE) form POST, a full-page GET match.redirect, a middleware redirect() short-circuit, a response-route 3xx — has no client in the loop, so those paths emitted the cross-origin Location unchecked.

Concretely, an app that does the common thing:

// route middleware or an action, target derived from request input
return redirect(ctx.searchParams.get("returnTo") ?? "/");

was protected with JS enabled but became an open redirect on the no-JS / full-page path (?returnTo=https://evil.example → the browser is sent off-site). The JS and no-JS paths disagreed.

What changed (consumer-visible)

redirect() is now same-origin by default on every path — JS, no-JS PE, and full-page. A cross-origin target without an explicit opt-in is neutralized to the app root (dev logs the blocked target). To redirect off-host on purpose, opt in:

// before — worked on no-JS, silently blocked on JS (inconsistent)
return redirect(userControlledUrl);

// after — same-origin everywhere; off-host requires the explicit opt-in
return redirect("https://accounts.google.com/o/oauth2/v2/auth?...", {
  external: true,
});

{ external: true } is the audit point (the Rails allow_other_host: true model): the attacker controls the URL value, never whether your code wrote external: true, so redirect(userInput) stays safe by construction.

End-to-end example

// urls.tsx — a login bounce that echoes ?returnTo
path("/login", LoginPage, { name: "login" }, () => [
  middleware((ctx, next) => {
    if (ctx.get("user")) return next();
    // returnTo is request-controlled; redirect() keeps it same-origin.
    return redirect(ctx.searchParams.get("returnTo") ?? "/login");
  }),
]),

// OAuth start — an intentional off-host redirect, explicitly opted in
path.any("/auth/google", () =>
  redirect("https://accounts.google.com/o/oauth2/v2/auth?client_id=...", {
    external: true,
  }),
),

With ?returnTo=https://evil.example, the no-JS browser now lands on /login, not evil.example. /auth/google still reaches Google.

Semantics

Plus two lower-severity hardenings in the same slice:

Code-change summary

The 14 unvalidated redirect exits a completeness sweep found all funnel into one place — the single return in createRSCHandler — so the fix is one chokepoint, not 12 patches, and is future-proof:

• src/redirect-origin.ts (new) — the ONE shared same-origin rule (resolveSameOriginRedirect + the internal EXTERNAL_REDIRECT_MARKER). Imported by both the client validator and the server guard so they cannot drift.
• src/browser/validate-redirect-origin.ts — rewired to the shared rule (behavior + tests unchanged).
• src/rsc/redirect-guard.ts (new) — guardOutgoingRedirect: same-origin passes; cross-origin → basename root + dev log; marker present → strip + allow.
• src/rsc/handler.ts — the chokepoint: return guardOutgoingRedirect(response, url.origin, router.basename). Soft SPA redirects are 200/204, so they pass through untouched (still validated client-side).
• src/route-definition/redirect.ts — external?: boolean option; stamps the internal marker.
• src/rsc/helpers.ts — interceptRedirectForPartial propagates external onto metadata.redirect.external (Flight) so the SPA channel does a hard location.assign; carryOverRedirectHeaders strips the marker so it never reaches the browser.
• src/browser/server-action-bridge.ts, partial-update.ts — honor metadata.redirect.external; two init-window hard-nav fallbacks (dispatchRedirect, rsc-router.tsx) re-validate defensively.
• src/rsc/origin-guard.ts — fail-closed when Host absent. src/rsc/server-action.ts — drop raw decode-error detail.
• src/testing/dispatch.ts — applies the guard at its final return so the public dispatch primitive mirrors the production chokepoint (consumers can unit-test the contract).

Test plan

• Unit — src/rsc/__tests__/redirect-guard.test.ts (guard + shared rule: same-origin pass, cross-origin → root, basename root, cookie preservation, external strip), route-definition/__tests__/redirect.test.ts (external marker), rsc/__tests__/helpers.test.ts (SPA external propagation + marker not leaked), rsc/__tests__/origin-guard.test.ts (3 fail-closed cases).
• Userland (via the @rangojs/router/testing dispatch primitive) — testing/__tests__/dispatch.test.ts: cross-origin middleware/response-route redirect → root; external allowed + marker stripped; same-origin passthrough. Pins the consumer-visible contract through the same primitive consumers use.
• E2E dev + production — e2e/redirect-guard.test.ts: full-page middleware block / protocol-relative block / same-origin allow / external allow (raw HTTP, maxRedirects: 0) + no-JS PE form-action cross-origin block (real browser, lands on root). Green in both modes.
• Regression e2e — origin-guard (prod), progressive-enhancement (dev + prod, confirms the kept no-JS <form action={fn}> fallback), semantic-matrix (dev 61 + prod 21).
• pnpm run typecheck, pnpm run test:unit:all (router + all consumer dogfood suites), pnpm run lint, pnpm run format.

Notes / call-outs

• #572 PE decodeReply-reject item is a false positive (declined, documented). Making the PE direct-action path reject on decode failure broke 3 no-JS form tests: decodeReply legitimately throws for a raw <form action={fn}> POST (no Flight-encoded args), and the [formData] fallback IS the React form-action convention. The JS↔PE divergence is intentional; progressive-enhancement.ts now carries a comment saying so.
• #572 action-ownership item deferred. Verifying an action ID "belongs to the matched route" fights the RSC global-action model (a shared layout action is invoked from many routes); no route→action ownership map exists. Documented as app responsibility rather than enforced.
• External redirects on the SPA channel ride metadata.redirect.external in the Flight payload and are honored client-side. This is the documented, explicit opt-out; a crafted response could set it, but that requires controlling the server response (a strictly larger compromise than open-redirect), and redirect(userInput) never carries the flag. Same trust model as Rails allow_other_host.
• Docs updated in-PR: docs/internal/security-checklist.md (new "Outgoing Redirect Guard" section + fail-closed note), feature-map.md, feature-file-map.md, and the server-actions skill.