callbackUrl 외부 도메인 리다이렉트 차단, 환경별 세션 쿠키 이름 분리

app/(auth)/login/actions.ts

@@ -5,8 +5,20 @@ import { redirect } from "next/navigation";
 
 import { signIn } from "@/auth";
 
+function sanitizeCallbackUrl(raw: string): string {
+  try {
+    const parsed = new URL(raw, "http://x");
+    if (parsed.origin !== "http://x") return "/";
+  } catch {
+    return "/";
+  }
+  return raw.startsWith("/") ? raw : "/";
+}
+
 export async function loginAction(formData: FormData) {
-  const callbackUrl = String(formData.get("callbackUrl") ?? "/");
+  const callbackUrl = sanitizeCallbackUrl(
+    String(formData.get("callbackUrl") ?? "/")
+  );
 
   try {
     await signIn("credentials", {