fix(security): prevent WebAuthn open redirect

Reject redirect targets with multiple leading slashes to prevent
browser navigation to attacker-controlled origins after login.

internal/urllib/url.go

@@ -36,9 +36,15 @@ func IsRelativePath(link string) bool {
 		return false
 	}
 
+	// Reject scheme-relative URLs, including forms with extra leading slashes
+	// that url.Parse treats as a relative path but browsers resolve externally.
+	if strings.HasPrefix(link, "//") {
+		return false
+	}
+
 	if parsedURL, err := url.Parse(link); err == nil {
-		// Only allow relative paths (not scheme-relative URLs like //example.org)
-		// and ensure the URL doesn't have a host component
+		// Only allow relative paths and ensure the URL doesn't have a host
+		// component.
 		if !parsedURL.IsAbs() && parsedURL.Host == "" && parsedURL.Scheme == "" {
 			return true
 		}

internal/urllib/url_test.go

@@ -29,6 +29,8 @@ func TestIsRelativePath(t *testing.T) {
 		"http://example.org/file.ext":  false,
 		"//example.org/file.ext":       false,
 		"//example.org":                false,
+		"///example.org":               false,
+		"////example.org/path":         false,
 		" //example.org":               false,
 		"  //example.org/path":         false,
 		"\t//example.org":              false,