adeelahmad · Oct 6, 2026 · Oct 6, 2026
diff --git a/fastapi_backend/app/domain/external_login.py b/fastapi_backend/app/domain/external_login.py
@@ -269,8 +269,10 @@ def start(db, cfg, key, origin, mode="login", account=None, next_path="/"):
 
 
 def _safe_next(path):
+    """A path on this site. Browsers drop tabs and line breaks from a URL ("/\\t/evil.example" is "//evil.example")."""
     path = path or "/"
-    return path if path.startswith("/") and not path.startswith("//") and "\\" not in path else "/"
+    ok = path.startswith("/") and not path.startswith("//") and "\\" not in path and not re.search(r"[\x00-\x1f\x7f]", path)
+    return path if ok else "/"
 
 
 def claim(db, state, browser):

diff --git a/fastapi_backend/tests/api/test_external_login.py b/fastapi_backend/tests/api/test_external_login.py
@@ -162,6 +162,8 @@ def test_the_round_trip_is_tied_to_this_browser_and_used_once(app, client, new_c
     # where to go next is always a page of this site
     got = _sign_in(client, idp, "acme-sso", ADA, next_path="//evil.example/x")
     assert got["next"] == "/"
+    got = _sign_in(client, idp, "acme-sso", ADA, next_path="/\t/evil.example/x")  # browsers drop the tab: //evil.example
+    assert got["next"] == "/"
 
 
 def test_a_wrong_client_secret_says_so(app, client, admin, idp, db):

diff --git a/nextjs-frontend/__tests__/externalSignIn.test.tsx b/nextjs-frontend/__tests__/externalSignIn.test.tsx
@@ -86,6 +86,7 @@ describe("coming back from the provider", () => {
     expect(safeNext("//evil.example")).toBe("/");
     expect(safeNext("https://evil.example")).toBe("/");
     expect(safeNext("/\\evil.example")).toBe("/");
+    expect(safeNext("/\t/evil.example")).toBe("/");
     expect(safeNext("/recordings?x=1")).toBe("/recordings?x=1");
   });
 });
diff --git a/nextjs-frontend/__tests__/navigation.test.ts b/nextjs-frontend/__tests__/navigation.test.ts
@@ -37,6 +37,9 @@ describe("safeCallbackUrl", () => {
     ["//evil.example", "/"],
     ["/\\evil.example", "/"],
     ["https://evil.example", "/"],
+    ["/\t/evil.example", "/"],
+    ["/\n/evil.example", "/"],
+    ["/\r/evil.example", "/"],
     [null, "/"],
   ])("%p -> %p", (input, expected) => {
     expect(safeCallbackUrl(input)).toBe(expected);

diff --git a/nextjs-frontend/components/auth/external-signin-return.tsx b/nextjs-frontend/components/auth/external-signin-return.tsx
@@ -5,10 +5,11 @@ import { useEffect, useState } from "react";
 
 import { AuthAlert, AuthCard } from "@/components/auth/auth-card";
 import { finishSignIn } from "@/components/auth/passkey-flows";
+import { safeCallbackUrl } from "@/lib/definitions";
 
 /** A page of this site to go to next (never another site). */
 export function safeNext(next: string | null | undefined, fallback = "/"): string {
-  return next && next.startsWith("/") && !next.startsWith("//") && !next.includes("\\") ? next : fallback;
+  return next && safeCallbackUrl(next) === next ? next : fallback;
 }
 
 function sentence(s: string): string {

diff --git a/nextjs-frontend/lib/definitions.ts b/nextjs-frontend/lib/definitions.ts
@@ -48,7 +48,9 @@ export type FormState =
     }
   | undefined;
 
-/** Only same-origin paths are allowed as post-login destinations. */
+/** Only same-origin paths are allowed as post-login destinations. Browsers drop tabs and line breaks from a URL, so
+ * "/\t/evil.example" would become "//evil.example": control characters and backslashes are refused anywhere. */
 export function safeCallbackUrl(value: unknown): string {
-  return typeof value === "string" && /^\/(?![/\\])/.test(value) ? value : "/";
+  // eslint-disable-next-line no-control-regex
+  return typeof value === "string" && /^\/(?![/\\])/.test(value) && !/[\x00-\x1f\x7f\\]/.test(value) ? value : "/";
 }