[Dashboard] Tighten login redirect path validation

[0xFirekeeper]

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Login redirects now reject URLs on thirdweb.com whose paths begin with //. Redirects must still use the thirdweb.com hostname, keeping accepted destinations within the expected URL format.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
thirdweb-www	Ready	Preview	Oct 12, 2026 9:23am UTC

4 Skipped Deployments

Project	Deployment	Actions	Updated
docs-v2	Skipped		Oct 12, 2026 9:23am UTC
nebula	Skipped		Oct 12, 2026 9:23am UTC
thirdweb_playground	Skipped		Oct 12, 2026 9:23am UTC
wallet-ui	Skipped		Oct 12, 2026 9:23am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 56f8910

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: f7fa0ff0-eee7-4b14-8fd7-3b2c5845738e

---

📥 Commits

Reviewing files that changed from the base of the PR and between 3b6c18d and 56f8910.

---

📒 Files selected for processing (1)

• apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

---

---

Walkthrough

The encoded redirect path validator now rejects URLs with a thirdweb.com hostname when the decoded pathname starts with //.

Changes

Redirect validation

Layer / File(s)	Summary
Validate decoded redirect path apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts	The validator requires the parsed hostname to be thirdweb.com and the pathname not to start with //.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 56f89

The change blocks decoded paths beginning with //. The inspected accepted cases remain same-origin, with no concrete merge-blocking redirect risk established.

Pre-merge checks | 3 | 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check		The description only states that Claude Code generated the pull request. It does not explain the redirect validation change or provide testing details.	Add a concise change summary under Notes for the reviewer and describe the unit tests or other testing performed under How to test.
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: tighter login redirect path validation in the Dashboard.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

size-limit report 📦

Path	Size
@thirdweb-dev/nexus (esm)	105.66 KB (0%)
@thirdweb-dev/nexus (cjs)	319.47 KB (0%)