Open Redirect in Login

1app.get('/login', (req, res) => {
2    const { returnUrl } = req.query;
3    
4    if (req.session.user) {
5        // Redirect to returnUrl after login
6        return res.redirect(returnUrl || '/dashboard');
7    }
8    
9    res.render('login', { returnUrl });
10});
11
12app.post('/login', (req, res) => {
13    const { username, password, returnUrl } = req.body;
14    
15    if (validateCredentials(username, password)) {
16        req.session.user = username;
17        res.redirect(returnUrl || '/dashboard');
18    } else {
19        res.render('login', { error: 'Invalid credentials' });
20    }
21});