Method: ActionController::Redirecting#url_from

Defined in:

lib/action_controller/metal/redirecting.rb

#url_from(location) ⇒ Object

Verifies the passed location is an internal URL that's safe to redirect to and returns it, or nil if not. Useful to wrap a params provided redirect URL and fall back to an alternate URL to redirect to:

redirect_to url_from(params[:redirect_url]) || root_url

The location is considered internal, and safe, if it's on the same host as request.host:

# If request.host is example.com:
url_from("https://example.com/profile") # => "https://example.com/profile"
url_from("http://example.com/profile")  # => "http://example.com/profile"
url_from("http://evil.com/profile")     # => nil

Subdomains are considered part of the host:

# If request.host is on https://example.com or https://app.example.com, you'd get:
url_from("https://dev.example.com/profile") # => nil

NOTE: there's a similarity with url_for, which generates an internal URL from various options from within the app, e.g. url_for(@post). However, #url_from is meant to take an external parameter to verify as in url_from(params[:redirect_url]).

# File 'lib/action_controller/metal/redirecting.rb', line 254

def url_from(location)
  location = location.presence
  location if location && _url_host_allowed?(location)
end