WN: IsLocalUrl (#34758)

* WN: IsLocalUrl

* WN: IsLocalUrl

* WN: IsLocalUrl

* WN: IsLocalUrl

Author: Rick-Anderson

aspnetcore/release-notes/aspnetcore-10.0.md

@@ -47,4 +47,24 @@ This section describes miscellaneous new features in ASP.NET Core 10.0.
 
 [!INCLUDE[](~/release-notes/aspnetcore-10/includes/testAppsTopLevel.md)]
 
+### Detect if URL is local using `RedirectHttpResult.IsLocalUrl`
+
+Use the new [`RedirectHttpResult.IsLocalUrl(url)`](https://source.dot.net/#Microsoft.AspNetCore.Http.Results/RedirectHttpResult.cs,c0ece2e6266cb369) helper method to detect if a URL is local. A URL is considered local if the following are true:
+
+- It doesn't have the [host](https://developer.mozilla.org/docs/Web/API/URL/host) or [authority](https://developer.mozilla.org/docs/Web/URI/Authority) section.
+- It has an [absolute path](https://developer.mozilla.org/docs/Learn_web_development/Howto/Web_mechanics/What_is_a_URL#absolute_urls_vs._relative_urls).
+
+URLs using [virtual paths](/previous-versions/aspnet/ms178116(v=vs.100)) '~/' are also local.
+
+`IsLocalUrl` is useful for validating URLs before redirecting to them to prevent [open redirection attacks](https://brightsec.com/blog/open-redirect-vulnerabilities/).
+
+```csharp
+if (RedirectHttpResult.IsLocalUrl(url))
+{
+    return Results.LocalRedirect(url);
+}
+```
+
+Thank you [@martincostello](https://github.com/martincostello) for this contribution!
+
 ## Related content