does the "next" value in the session need to be validated?

[coreybrett]

I've added the following code to my app...

config['USE_SESSION_FOR_NEXT'] = True 

@portalbp.route('/login', methods=['GET', 'POST'])
def login():
	form = forms.LoginForm()
	if form.validate_on_submit():
		login_user(form.user, remember=False)
		destination = session.pop('next', None)
		return redirect(destination or url_for('portal.index'))
	return render_template('portal/login.html', form=form)

I do not have a custom unauthorized_handler.

If explicit validation is necessary, is that functionality builtin, or do I need to supply it?

[alanhamlett]

I believe only urls in your app can be added to session['next'] but you should always validate urls before redirecting using something like is_safe_url. It's not hard and definitely worth the extra piece of mind.

[alanhamlett]

Related to #371 and pallets/werkzeug#609.