Method Back

redirect.go:381–404

Back redirect to the URL to referer. It validates that the Referer is same-origin to prevent open redirect attacks. If the Referer is missing, invalid, or cross-origin, the fallback URL is used.

(fallback ...string)

// It validates that the Referer is same-origin to prevent open redirect attacks.
// If the Referer is missing, invalid, or cross-origin, the fallback URL is used.
func (r *Redirect) Back(fallback ...string) error {
	location := r.c.Get(HeaderReferer)
	if location != "" {
		if !strings.HasPrefix(location, "/") || strings.HasPrefix(location, "//") {
			parsed, err := url.Parse(location)
			if err != nil || (parsed.Scheme != "" && parsed.Host == "") || (parsed.Host != "" && !schemehost.Match(parsed.Scheme, parsed.Host, r.c.Scheme(), r.c.Host())) {
				location = "" // Reject invalid or cross-origin referrers
			}
		}
	}

	if location == "" {
		// Check fallback URL
		if len(fallback) == 0 {
			err := ErrRedirectBackNoFallback
			r.c.Status(err.Code)

			return err
		}
		location = fallback[0]
	}

	return r.To(location)
}

// parseAndClearFlashMessages is a method to get flash messages before they are getting removed
func (r *Redirect) parseAndClearFlashMessages() {