Adonisjs, Nodejs.
absolutely filter the returnTo URL to exclude those endpoints, otherwise you can be susceptible to phishing and other attacks. Security Note #2: If you’re doing a custom login flow with additional session parameters, you should always call session.regenerate to prevent session fixation attacks