Enforce configured host on user supplied returnTo

[adamjmcgrath]

Description

This PR changes how the user supplied returnTo param from /api/auth/login is sanitized.

Instead of using a regexp like a block list to prevent URLs that aren't relative from being accepted, it converts the URL to absolute using the configured redirect_uri as a base. It then enforces that the absolute URL has the same origin as the configured redirect_uri.

This will ensure that only valid URLs with the same origin as the configured redirect_uri (or baseURL) are accepted as returnTo URLs.

References

Fixes #545
See also #555

Testing

Tested using https://github.com/adamjmcgrath/open-redirect-finder

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/auth0/nextjs-auth0/Dbzo2rT8j7GgFr2vsAib7PTYst7a
✅ Preview: Canceled

[Deployment for fe0673c canceled]

[Widcket]

The implementation looks good, just there are some improvement opportunities in the tests.