fix(web): a post-login target that normalizes to //host goes home

apps/web/src/components/auth/RateAuthPortal.tsx

@@ -46,7 +46,13 @@ export function sanitizeAuthRedirectTarget(rawTarget: unknown): string {
   }
   try {
     const parsed = new URL(cleaned, 'https://rate.vn');
-    if (parsed.origin !== 'https://rate.vn') {
+    // Dot segments ("/.//x", "/%2e//x", "/a/..//x") normalize to a "//x" path,
+    // which a router reads as another host: never a target.
+    if (
+      parsed.origin !== 'https://rate.vn' ||
+      parsed.pathname.startsWith('//') ||
+      parsed.pathname.includes('\\')
+    ) {
       return '/';
     }
     return `${parsed.pathname}${parsed.search}${parsed.hash}`;

apps/web/src/proxy.ts

@@ -65,7 +65,8 @@ export function localeProxy(req: NextRequest): NextResponse {
   const localePrefixMatch = pathname.match(/^\/(vi|en|cs)(\/.*)?$/);
   if (localePrefixMatch) {
     const matchedLocale = localePrefixMatch[1]!;
-    const cleanPath = localePrefixMatch[2] || '/';
+    // One leading slash: "/en//host" must not become a protocol-relative Location.
+    const cleanPath = `/${(localePrefixMatch[2] ?? '').replace(/^\/+/, '')}`;
     const redirectUrl = req.nextUrl.clone();
     redirectUrl.pathname = cleanPath;
     const response = NextResponse.redirect(redirectUrl, 308);

apps/web/src/server/rate/__tests__/core-rate-architecture.test.ts

@@ -367,6 +367,17 @@ async function runCoreArchitectureSuite() {
     'https://rate.vn/compare'
   );
   assert.equal(redirectCsCompare.cookies.get('NEXT_LOCALE')?.value, 'cs');
+  // A doubled slash after the locale stays on the site (no "//host" target).
+  const redirectEnDoubleSlash = middleware(
+    new NextRequest('https://rate.vn/en//evil.example/x', {
+      headers: { 'x-forwarded-proto': 'https', host: 'rate.vn' },
+    })
+  );
+  assert.equal(redirectEnDoubleSlash.status, 308);
+  assert.equal(
+    redirectEnDoubleSlash.headers.get('location'),
+    'https://rate.vn/evil.example/x'
+  );
 
   const unprefixedEnRes = middleware(
     new NextRequest('https://rate.vn/', {
@@ -12872,6 +12883,17 @@ async function runCoreArchitectureSuite() {
     assert.equal(sanitizeAuthRedirectTarget('javascript:alert(1)'), '/');
     assert.equal(sanitizeAuthRedirectTarget(null), '/');
     assert.equal(sanitizeAuthRedirectTarget(`/${'a'.repeat(600)}`), '/');
+    // Dot segments that normalize to a protocol-relative path.
+    for (const target of [
+      '/.//evil.example/phish',
+      '/%2e//evil.example/phish',
+      '/%2E//evil.example',
+      '/a/..//evil.example/phish',
+      '/././/evil.example',
+    ]) {
+      assert.equal(sanitizeAuthRedirectTarget(target), '/', target);
+    }
+    assert.equal(sanitizeAuthRedirectTarget('/a/../watchlist'), '/watchlist');
 
     assert.equal(outcomeFromJobState('skipped_no_consent'), 'noConsent');
     assert.equal(outcomeFromJobState('rejected_invalid_url'), 'invalidUrl');