Option to turn off built in 'back' functionality in res.location('back')

[WORMSS]

I had spotted there were no tests for res.location('back') so I have added them.

I came across this because I was trying to navigate to the relative page called 'back' and was being redirected to domain root. It was not expected. After looking at the code I spotted there was a "special" case for the word "back".

[dougwilson]

Hi @WORMSS as for the "It was not expected" comment, I felt like your documentation was pretty good (http://expressjs.com/en/4x/api.html#res.location). How can we improve it?

[WORMSS]

Oh, by "not expected" I mean I was expecting the exact result I put it to come out. After seeing the code and reading the docs, I understood why it was there.. But I was using "location" without realising there was special case for the word "back". If it had been something like :back or :referrer, something that is not a valid url safe, then I doubt I would have encountered it.

[dougwilson]

Gotcha, so you're saying that the behavior was expected to treat back specially from what was in the documentation, you just think it could be done differently. You're not saying that it was undocumented and that there is any improvement we can make to the docs to make it clearer that using the string 'back' does not literally make the location 'back', right?

The reason I'm asking is because we can't change the behavior in 4.x, but I don't want people to not realize what is happening, so want to make sure that our documentation is sufficient such that it is not unexpected behavior.

[WORMSS]

As you have said in #3291 if you have the ability to remove the magic back code from 5.x, I would put my vote for that. You could keep the functionality, as I said above, maybe something that just isn't a common word, or something that is a valid referrer..
But no, your documentation on the use of the magic back is good.. I just hadn't read it before I stumped myself with it.

[bjohansebas]

#3291 (comment)