module ActionController::Redirecting

However, #url_from is meant to take an external parameter to verify as in url_from(params[:redirect_url]).
NOTE: there's a similarity with {url_for}[rdoc-ref:ActionDispatch::Routing::UrlFor#url_for], which generates an internal URL from various options from within the app, e.g. url_for(@post).

url_from("https://dev.example.com/profile") # => nil
# If request.host is on https://example.com or https://app.example.com, you'd get:

Subdomains are considered part of the host:

url_from("http://evil.com/profile") # => nil
url_from("http://example.com/profile") # => "http://example.com/profile"
url_from("https://example.com/profile") # => "https://example.com/profile"
# If request.host is example.com:

The +location+ is considered internal, and safe, if it's on the same host as request.host:

redirect_to url_from(params[:redirect_url]) || root_url

Useful to wrap a params provided redirect URL and fall back to an alternate URL to redirect to:
Verifies the passed +location+ is an internal URL that's safe to redirect to and returns it, or nil if not.

def url_from(location)
  location = location.presence
  location if location && _url_host_allowed?(location)
end