agent foundation

lib/Http/Request.php

@@ -30,6 +30,8 @@ class Request
         return self::stripBasePath($path);
     }
 
+    // Returns a safe redirect target after login — guards against open-redirect attacks
+    // by rejecting any value with a scheme or host (i.e. an absolute external URL).
     public static function safeReturnTarget(string $returnParam = ''): string
     {
         if ($returnParam !== '') {