Authentication redirect hardening
Pro Prisma and Pro Drizzle now validate post-authentication destinations and invitation identifiers before redirecting users.
Both starter kits now validate authentication destinations before navigating. Sign-in, sign-up, two-factor verification, social sign-in and onboarding accept only internal application paths and fall back to the configured dashboard route when a destination is external or malformed.
What changed
- Added one shared redirect validator for authentication and onboarding flows.
- Reject external URLs, protocol-relative URLs and malformed URL encoding.
- Preserve valid internal paths together with their query strings and hashes.
- Validate organization invitation identifiers as UUIDs before constructing an invitation route or forwarding the identifier during registration.
- Corrected the social sign-in invitation callback to use the current dashboard invitation route.
- Reused the same invitation validation in the server-side registration guard.
Verification
The release adds focused coverage for valid internal destinations, unsafe external destinations, malformed values and valid or invalid invitation IDs. All unit tests and TypeScript checks pass in both editions, and both production applications compile successfully with Next.js 16.3.0.
Existing projects
No database migration or configuration change is required. Existing projects can adopt the shared redirect helper and update the authentication and onboarding call sites included in this release.
See the authentication guidance for Pro Prisma or Pro Drizzle.