From a466664dfbacd18268b6a0e784ca339dac872d8b Mon Sep 17 00:00:00 2001 From: Ofri Peretz Date: Fri, 31 Jul 2026 15:20:34 -0500 Subject: [PATCH] docs: fix ReferenceError in open-redirect example (Url -> URL) The open-redirect validation example calls `new Url(...)`, but the JavaScript global is `URL`. As written, the constructor throws ReferenceError on every request, the catch block swallows it, and the example responds 400 "Invalid url" for every URL - including valid ones - so the redirect never runs. Anyone copying the snippet gets a handler that silently rejects all redirects instead of validating them. --- src/content/pages/en/advanced/best-practice-security.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/pages/en/advanced/best-practice-security.mdx b/src/content/pages/en/advanced/best-practice-security.mdx index b15dcb1187..87361f3984 100644 --- a/src/content/pages/en/advanced/best-practice-security.mdx +++ b/src/content/pages/en/advanced/best-practice-security.mdx @@ -64,7 +64,7 @@ Here is an example of checking URLs before using `res.redirect` or `res.location ```js app.use((req, res) => { try { - if (new Url(req.query.url).host !== 'example.com') { + if (new URL(req.query.url).host !== 'example.com') { return res.status(400).end(`Unsupported redirect to host: ${req.query.url}`); } } catch (e) {