Changelog

This changelog follows the keep a changelog format. This project adheres to Semantic Versioning.

Unreleased

Accept a single string or URI struct as :allowed_redirect_uris.
Add the SafeRedirect.uri_source/0, SafeRedirect.allowed_redirect_uris/0, and SafeRedirect.opts/0 types.

Raise ArgumentError if invalid options are passed as :allowed_redirect_uris.
Raise ArgumentError if an unsupported option key is passed.
Raise ArgumentError if an allowed redirect URI has no scheme or host.
Raise ArgumentError if an allowed redirect URI has a path, query string, fragment, or userinfo.
Raise ArgumentError if the host of an allowed redirect URI has a trailing dot.
Raise ArgumentError if an allowed redirect URI cannot be parsed.
Always set the response content type to text/html when redirecting a Plug.Conn.

Accept percent-encoded paths. /caf%C3%A9 and /some%20path were previously rejected, so a redirect target containing a space or a non-ASCII character could not be expressed.
Accept paths with a trailing slash (/some/path/) or repeated slashes (/some//path), which were previously rejected.
Compare the host case-insensitively, per RFC 3986.
SafeRedirect.valid_url?/2 raised FunctionClauseError for nil. It now returns false, matching SafeRedirect.resolve_url/3.
SafeRedirect.redirect/4 raised UndefinedFunctionError in applications that depend on Plug but not on Phoenix. It now uses Plug.Conn directly instead of Phoenix.Controller.
Refuse a percent-encoded default value that resolves to a protocol-relative URL, such as /%2F%2Fevil.example or /%5Cevil.example.
Accept URI structs for the URL and the default value in SafeRedirect.redirect/4.
Raise ArgumentError instead of CaseClauseError if the resolved URL cannot be redirected to.

Type specification of SafeRedirect.resolve_url/3 didn't allow nil as default value.

Initial release