unsafeHref

Marks a run-time path as a navigation target the router may use. Use it only for a path that a check has already accepted: a redirect_url read from the request and validated, or a return path stored by the app. It is not a way around the registered routes for user input.

In development the path must be same-origin: a relative path (dashboard/files) or a root path (/sign-in?x=1). An absolute URL to another origin, a javascript: URL, and a protocol-relative //host are refused with a TypeError. Production builds return the path unchecked (the check costs a URL parse per call; the validation belongs where the input arrives).

Import#

import { unsafeHref } from "@shadow-js/router";

Signature#

function unsafeHref(path: string): RuntimeHref

Parameters#

Returns#

The path, branded as RuntimeHref.

Throws#

• TypeError in development when the path is not same-origin.

Examples#

const back = unsafeHref(safeReturnTo(searchParams.get("redirect_url")));
navigate(back);