Merge branch '4.x' into serve-static-send-patch

expressjs · Sep 11, 2024 · 1be40ec · 1be40ec
2 parents c43b880 + 40d2d8f
commit 1be40ec
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 1 deletion.
diff --git a/History.md b/History.md
@@ -1,8 +1,10 @@
 unreleased
 ==========
 
+  * Deprecate `res.location("back")` and `res.redirect("back")` magic string
   * deps: [email protected]
     * includes [email protected]
+  * deps: [email protected]
 
 4.20.0 / 2024-09-10
 ==========

diff --git a/lib/response.js b/lib/response.js
@@ -916,6 +916,7 @@ res.location = function location(url) {
 
   // "back" is an alias for the referrer
   if (url === 'back') {
+    deprecate('res.location("back"): use res.location(req.get("Referrer") || "/") and refer to https://dub.sh/security-redirect for best practices');
     loc = this.req.get('Referrer') || '/';
   } else {
     loc = String(url);

diff --git a/package.json b/package.json
@@ -40,7 +40,7 @@
     "encodeurl": "~2.0.0",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "1.2.0",
+    "finalhandler": "1.3.1",
     "fresh": "0.5.2",
     "http-errors": "2.0.0",
     "merge-descriptors": "1.0.3",