fix(api): strip query params on redirect (#58608)

api/src/utils/redirection.test.ts

@@ -165,6 +165,23 @@ describe('redirection', () => {
       expect(result).toEqual(expectedReturn);
     });
 
+    it('should strip off any query parameters from the referer', () => {
+      const req = {
+        headers: {
+          referer: `https://www.freecodecamp.org/espanol/learn/rosetta-code/?query=param`
+        }
+      };
+
+      const expectedReturn = {
+        origin: 'https://www.freecodecamp.org',
+        pathPrefix: 'espanol',
+        returnTo: 'https://www.freecodecamp.org/espanol/learn/rosetta-code/'
+      };
+
+      const result = getRedirectParams(req);
+      expect(result).toEqual(expectedReturn);
+    });
+
     it('should use HOME_LOCATION with missing referer', () => {
       const req = {
         headers: {}

api/src/utils/redirection.ts

@@ -113,7 +113,12 @@ function getParamsFromUrl(
   // if this is not one of the client languages, validation will convert
   // this to '' before it is used.
   const pathPrefix = returnUrl.pathname.split('/')[1] ?? '';
-  return normalize({ returnTo: returnUrl.href, origin, pathPrefix });
+  return normalize({
+    // strip off any query parameters
+    returnTo: returnUrl.origin + returnUrl.pathname,
+    origin,
+    pathPrefix
+  });
 }
 
 /**