fix multi-level redirect in server actions

[ztanner]

redirect in server actions has handling to support relative redirects (eg redirect('./foo')) but it doesn't handle a multi-level relative path, eg redirect('../foo').

This used to work by accident because the invalid URL would be handled as an error and then would trigger an MPA navigation. In Next 15, it surfaces an actual error because we are less tolerant to them.

Fixes #72765
Closes NDX-479

[ztanner]

• fix multi-level redirect in server actions #72770 👈
• canary

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @ztanner and the rest of your teammates on Graphite

[devjiwonchoi]

In Next 15, it surfaces an actual error because we are less tolerant to them.

Q: So would the added test be passing on v14?

Would be great if you explain/ref about how we are less tolerant.

[ztanner]

Q: So would the added test be passing on v14?

I added an MPA navigation check in 9e137bd

Would be great if you explain/ref about how we are less tolerant.

Previously the relative redirect check only looked for the redirectUrl starting with / to determine if it was relative. (ref). If it wasn't a relative redirect, we returned a static response, which signals to the client that it should perform an MPA navigation. This is the code path that was being hit in Next 14.

In #64604, this was updated to parse the URL via new URL() to determine if it was a relative redirect. This would actually throw an error because it doesn't correctly append an origin, as it assumed it was a fully qualified path.