Daily security quiz #12

Question for 2026-11-12. Read the code and pick the most serious security vulnerability.

This code sends users back to the page they were viewing after login. What is the most serious vulnerability?

1app.post('/login', async (req, res) => {
2  const user = await authenticate(req.body.id, req.body.password);
3  if (!user) return res.status(401).send('Login failed');
4  req.session.userId = user.id;
5  res.redirect(req.query.next || '/');
6});

1. AThe login failure message is too detailed
2. BPasswords must be hashed to prevent session fixation attacks
3. Credirect cannot be used with POST requests
4. DAn external URL can be placed in next to send users to a phishing site (open redirect)