New answers tagged validation
Is redirecting only to URLs that start with "/" sufficient validation? If you are passing the URL to redirect to as a URL parameter then you still need to validate (or at least sanitize) it as much as possible. Remove any strange characters, strip (or validate) the query string, etc. You should also be constructing an absolute URL for your Location: ...
Note also that web browsers are not required to perform any validation checks. Older browsers don't do anything special with the email address. Newer browsers may validate, but the 'email' type is most useful on mobile devices where a specialized keyboard may be shown to the user.
You could edit your hosts file or run a DNS server on a local network to create a machine with a top level domain name. The email address will be only accessible if it's routed only within that local network but it's a possible configuration.
It is valid because test could be a top-level domain and localpart@top-level-domain is a valid email address. See for example Email address, domain part
Top 50 recent answers are included