feat(protect): off_origin match type for open-redirect detection

[patchstackdave]

Why

Threading the request into the response phase (#106) unlocked response rules that compare the request to the response. The first and most demoable is open-redirect: a vulnerable endpoint that 302-redirects to an attacker-controlled off-site URL. Previously the skill listed this as "needs an engine change."

What

New off_origin response-phase match type (dispatched like cross_origin, since it needs the whole resolver):

• Matches (→ action: block) when a 3xx response's Location host differs from the request Host.
• A relative or same-origin Location never matches; lenient when there's no request Host (can't compare → don't flag). So it can't false-positive without the signal.

Also: reqContextFromFetch now derives the request Host from the URL (a fetch Request doesn't expose a Host header), which origin-comparing response rules need. This is what makes off_origin — and later CORS-reflection — work on the fetch path.

Not a default rule — legitimate off-site redirects are common (OAuth, payments). It's authored and route-scoped:

{ "phase": "response", "category": "open-redirect", "action": "block",
  "when": { "path": "/auth/callback" },
  "rule_v2": [{ "match": { "type": "off_origin" } }] }

Tests

tests/protect/open-redirect.test.ts — 6: off-origin blocked, same-origin/relative allowed, non-3xx ignored, no-request-context lenient, when route scope. 632 pass; typecheck clean.

Follow-up

Update the triage-vpatch-npm skill: move open-redirect from "not yet supported" to a real template. (Separate change — the skill lives in triage-tools + the hub's vendored copy.)

🤖 Generated with Claude Code

[coderbuds]

Adds focused open-redirect detection with clear origin comparison logic.

🎯 Quality: 100% Elite · 📦 Size: Small

📈 This month: Your 50th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review