dinou 4.0.11 → 4.0.13

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [4.0.13] - 2026-06-29
+
+### Added
+- **Universal Redirects**: Full support for redirects on Server Components, `getProps`, Server Actions, and client SPA navigation.
+- **Standard Relative Paths**: Support for relative paths (`../sibling`, `./child`, `?query`, `#hash`) matching directory-first URL resolution.
+- **Absolute Link Hover**: Links now render resolved absolute paths to ensure correct browser previews and right-click behaviors.
+
+### Fixed
+- **RSC Stream Stability**: Resolved socket crashes (`Connection closed`) and duplicate Express header warnings when redirects occur during streamed RSC requests.
+- **SSR Process Leaks**: Render processes are now cleaned up immediately after an HTML redirect is triggered.
+
+### Security
+- **Redirect Sanitization**: Blocked unsafe external domains (`https://...`), protocol-relative URLs (`//...`), and scripting payloads (`javascript:...`).
+
+### Refactored
+- **Shared Helpers**: Unified path resolution logic into a shared module (`url-resolver.js`).
+
+## [4.0.12] - 2026-06-28
+
+### Security
+- **Fix DOM XSS / Script Injection Vulnerability:** Replaced inline HTML/Script injection (`<script>` tags executed via `createContextualFragment` in client-side proxies) with a secure, data-driven line-based protocol for active streams and custom HTTP headers/JSON payload signaling for redirects.
+- **CSP (Content Security Policy) Compatibility:** Removed all `'unsafe-inline'` script injections, ensuring full compatibility with strict security policies.
+
+### Fixed
+- **Stream Redirection & Cookie Handling:** Improved robustness and predictability of stream reading in server-function proxies by switching to a line-by-line (`\n` delimited) streaming command parser, eliminating regex-based tag extraction.
+
 ## [4.0.11]
 
 ### Fixed

package/dinou/core/client-webpack.jsx

@@ -38,7 +38,7 @@ const isHashChangeOnly = (finalPath) => {
   );
 };
 
-const getRSCPayload = (rscKey) => {
+const getRSCPayload = (rscKey, isPrefetch = false) => {
   const url = rscKey.split("::")[0];
   // 1. Check Idempotence (Avoids the infinite loop of React)
   if (cache.has(url)) {
@@ -64,7 +64,21 @@ const getRSCPayload = (rscKey) => {
   }
 
   // 3. Fetch and Cache Storage
-  const promise = createFromFetch(fetch(payloadUrl));
+  const promise = createFromFetch(
+    fetch(payloadUrl).then((res) => {
+      if (res.headers.has("x-rsc-redirect")) {
+        const redirectUrl = res.headers.get("x-rsc-redirect");
+        if (!isPrefetch) {
+          window.location.href = redirectUrl;
+        } else {
+          cache.delete(url);
+        }
+        // Return a promise that never resolves to avoid React Server DOM throwing "Connection closed"
+        return new Promise(() => {});
+      }
+      return res;
+    }),
+  );
   cache.set(url, promise); // <--- KEY TO AVOID LOOP
   return promise;
 };
@@ -84,7 +98,7 @@ function Router() {
     window.__DINOU_PREFETCH__ = (url) => {
       // 🛡️ PREFETCH PROTECTION: If it's a local hash, do nothing
       if (isHashChangeOnly(url)) return;
-      getRSCPayload(url);
+      getRSCPayload(url, true);
     };
 
     // Hydration

package/dinou/core/client.jsx

@@ -39,7 +39,7 @@ const isHashChangeOnly = (finalPath) => {
   );
 };
 
-const getRSCPayload = (rscKey) => {
+const getRSCPayload = (rscKey, isPrefetch = false) => {
   const url = rscKey.split("::")[0];
   // 1. Check Idempotence (Avoids the infinite loop of React)
   if (cache.has(url)) {
@@ -65,7 +65,21 @@ const getRSCPayload = (rscKey) => {
   }
 
   // 3. Fetch and Cache Storage
-  const promise = createFromFetch(fetch(payloadUrl));
+  const promise = createFromFetch(
+    fetch(payloadUrl).then((res) => {
+      if (res.headers.has("x-rsc-redirect")) {
+        const redirectUrl = res.headers.get("x-rsc-redirect");
+        if (!isPrefetch) {
+          window.location.href = redirectUrl;
+        } else {
+          cache.delete(url);
+        }
+        // Return a promise that never resolves to avoid React Server DOM throwing "Connection closed"
+        return new Promise(() => {});
+      }
+      return res;
+    }),
+  );
   cache.set(url, promise); // <--- KEY TO AVOID LOOP
   return promise;
 };
@@ -85,7 +99,7 @@ function Router() {
     window.__DINOU_PREFETCH__ = (url) => {
       // 🛡️ PREFETCH PROTECTION: If it's a local hash, do nothing
       if (isHashChangeOnly(url)) return;
-      getRSCPayload(url);
+      getRSCPayload(url, true);
     };
 
     // Hydration

package/dinou/core/link.jsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useRouter } from "./navigation.js";
+import { useRouter, usePathname } from "./navigation.js";
 import { resolveUrl } from "./navigation-utils.js";
 
 export function Link({
@@ -11,12 +11,13 @@ export function Link({
   ...props
 }) {
   const { push } = useRouter();
+  const pathname = usePathname();
+  const resolvedHref = resolveUrl(href, pathname);
 
   const handlePrefetch = () => {
     if (!prefetch || !href || fresh) return;
-    const finalPath = resolveUrl(href, window.location.pathname);
     if (window.__DINOU_PREFETCH__) {
-      window.__DINOU_PREFETCH__(finalPath);
+      window.__DINOU_PREFETCH__(resolvedHref);
     }
   };
 
@@ -29,7 +30,7 @@ export function Link({
 
   return (
     <a
-      href={href}
+      href={resolvedHref}
       onClick={handleClick}
       onMouseEnter={handlePrefetch}
       {...props}

package/dinou/core/navigation-utils.js

@@ -1,13 +1,15 @@
 export function resolveUrl(href, currentPathname) {
+  const origin = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+
   if (href.startsWith("/") || href.includes("://")) {
-    const url = new URL(href, window.location.origin);
+    const url = new URL(href, origin);
     return normalize(url.pathname + url.search + url.hash);
   }
 
   let base = currentPathname;
   if (!base.endsWith("/")) base += "/";
 
-  const resolved = new URL(href, window.location.origin + base);
+  const resolved = new URL(href, origin + base);
   return normalize(resolved.pathname + resolved.search + resolved.hash);
 }
 

package/dinou/core/render-app-to-html.js

@@ -27,6 +27,8 @@ const childExecArgv = ESSENTIAL_NODE_ARGS.concat(loaderArg);
 
 // ----------------------------------------------------
 
+const { resolveRelativeUrl } = require("./url-resolver");
+
 function renderAppToHtml(
   reqPath,
   paramsString,
@@ -82,13 +84,28 @@ function renderAppToHtml(
         if (res.headersSent) {
           // --- REDIRECT (JS Injection) ---
           if (command === "redirect") {
-            const url = args.length === 1 ? args[0] : args[1];
+            const rawUrl = args.length === 1 ? args[0] : args[1];
+            const resolvedUrl = resolveRelativeUrl(rawUrl, reqPath);
             console.log(
-              `[Dinou] Streaming active. Redirecting via JavaScript to: ${url}`,
+              `[Dinou] Streaming active. Redirecting via JavaScript to: ${resolvedUrl}`,
             );
-            const safeUrl = JSON.stringify(url);
+            let finalUrl = "/";
+            if (
+              typeof resolvedUrl === "string" &&
+              resolvedUrl.startsWith("/") &&
+              !resolvedUrl.startsWith("//")
+            ) {
+              finalUrl = resolvedUrl;
+            } else {
+              console.warn(
+                `[Dinou Security] Blocked unsafe streaming redirect to: ${rawUrl}`,
+              );
+            }
+            const safeUrl = JSON.stringify(finalUrl);
             res.write(`<script>window.location.href = ${safeUrl};</script>`);
             res.end();
+            child.stdout.unpipe(res);
+            child.kill();
             return;
           }
 
@@ -186,16 +203,19 @@ function renderAppToHtml(
             rawUrl = args[0];
           }
 
+          // Resolve relative URL relative to reqPath
+          const resolvedUrl = resolveRelativeUrl(rawUrl, reqPath);
+
           // 2. Security Logic (Safe Redirect)
           // We allow only relative routes starting with '/' but not '//'
           let finalUrl = "/";
 
           if (
-            typeof rawUrl === "string" &&
-            rawUrl.startsWith("/") &&
-            !rawUrl.startsWith("//")
+            typeof resolvedUrl === "string" &&
+            resolvedUrl.startsWith("/") &&
+            !resolvedUrl.startsWith("//")
           ) {
-            finalUrl = rawUrl;
+            finalUrl = resolvedUrl;
           } else {
             console.warn(
               `[Dinou Security] Blocked unsafe redirect to: ${rawUrl}`,
@@ -205,6 +225,8 @@ function renderAppToHtml(
 
           // 3. Execute safe redirect always using (status, url)
           res.redirect.apply(res, [status, finalUrl]);
+          child.stdout.unpipe(res);
+          child.kill();
           return;
         }
 

package/dinou/core/server-function-proxy-webpack.js

@@ -1,5 +1,9 @@
 import { createFromFetch } from "react-server-dom-webpack/client";
 
+function isSafeRedirect(url) {
+  return typeof url === "string" && url.startsWith("/") && !url.startsWith("//");
+}
+
 function createServerFunctionProxy(id) {
   return new Proxy(() => { }, {
     apply: async (_target, _thisArg, args) => {
@@ -30,15 +34,30 @@ function createServerFunctionProxy(id) {
 
       if (!res.ok) throw new Error("Server function failed");
 
+      // Check header first
+      const redirectUrl = res.headers.get("X-Dinou-Redirect");
+      if (redirectUrl) {
+        window.location.href = isSafeRedirect(redirectUrl) ? redirectUrl : "/";
+        return new Promise(() => { });
+      }
+
       const contentType = res.headers.get("content-type") || "";
 
-      // Case 1: Pure HTML (Simple Redirect)
+      // Reject unexpected HTML responses entirely to prevent security bugs
       if (contentType.includes("text/html")) {
         const html = await res.text();
-        const range = document.createRange();
-        const documentFragment = range.createContextualFragment(html);
-        document.body.appendChild(documentFragment);
-        return new Promise(() => { });
+        console.warn("[Dinou] Received unexpected HTML response from server function:", html);
+        throw new Error("Unexpected HTML response from server function");
+      }
+
+      // Check if it's application/json (Scenario A clean redirect or json response)
+      if (contentType.includes("application/json")) {
+        const data = await res.json();
+        if (data && data.redirect) {
+          window.location.href = isSafeRedirect(data.redirect) ? data.redirect : "/";
+          return new Promise(() => { });
+        }
+        return data;
       }
 
       // Case 2: RSC or Hybrid Stream (Buffered)
@@ -46,7 +65,6 @@ function createServerFunctionProxy(id) {
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         const encoder = new TextEncoder();
-        const scriptRegex = /<script>(.*?)<\/script>/gs;
 
         const readableStream = new ReadableStream({
           async start(controller) {
@@ -58,16 +76,20 @@ function createServerFunctionProxy(id) {
                 const { done, value } = await reader.read();
 
                 if (done) {
-                  // If something remains in the buffer upon finishing, we send it (as long as it's not a broken script)
                   if (buffer.length > 0) {
-                    // CHECK: We search for the tag start, whether it has the closing > or not
-                    if (buffer.includes("<script")) {
-                      console.warn(
-                        "[Dinou] Stream ended with incomplete script. Discarding tail.",
-                      );
-                      // We do not enqueue.
+                    if (buffer.startsWith("D:")) {
+                      try {
+                        const payload = JSON.parse(buffer.slice(2));
+                        if (payload.type === "redirect") {
+                          isRedirecting = true;
+                          window.location.href = isSafeRedirect(payload.url) ? payload.url : "/";
+                        } else if (payload.type === "cookie") {
+                          document.cookie = payload.cookie;
+                        }
+                      } catch (e) {
+                        console.error("[Dinou] Failed to parse stream command line at end:", e);
+                      }
                     } else {
-                      // It is safe content (e.g., "a < b" or a cut JSON that React will handle)
                       controller.enqueue(encoder.encode(buffer));
                     }
                   }
@@ -77,65 +99,46 @@ function createServerFunctionProxy(id) {
                 // 1. ACCUMULATE
                 buffer += decoder.decode(value, { stream: true });
 
-                // 2. PROCESS COMPLETE SCRIPTS
-                // We search for complete pairs of <script>...</script>
-                let match;
+                // 2. PROCESS COMPLETE LINES
+                const lastNewlineIndex = buffer.lastIndexOf("\n");
+                if (lastNewlineIndex !== -1) {
+                  const completeChunk = buffer.slice(0, lastNewlineIndex + 1);
+                  buffer = buffer.slice(lastNewlineIndex + 1);
 
-                // We execute all complete scripts we find
-                while ((match = scriptRegex.exec(buffer)) !== null) {
-                  const fullMatch = match[0];
-                  const scriptContent = match[1];
+                  const lines = completeChunk.split("\n");
+                  let cleanChunk = "";
 
-                  // Detect redirect
-                  if (scriptContent.includes("window.location.href")) {
-                    isRedirecting = true;
-                  }
-
-                  // Inject to DOM
-                  const range = document.createRange();
-                  const fragment = range.createContextualFragment(fullMatch); // fullMatch includes tags for correct context
-                  document.body.appendChild(fragment);
-                }
+                  for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (!line && i === lines.length - 1) {
+                      continue;
+                    }
 
-                // 3. CLEAN PROCESSED SCRIPTS FROM BUFFER
-                // Once executed, we remove them so they don't go to React
-                buffer = buffer.replace(scriptRegex, "");
-
-                // 4. CALCULATE WHAT IS SAFE TO SEND (The anti-cut logic)
-                // We need to know if the buffer ends with something that LOOKS like the start of a script
-                // Dangerous patterns at the end: <, <s, <sc, <scr, <scri, <scrip, <script
-
-                let cutoffIndex = buffer.length; // Default send everything
-
-                // A) If there is an open but not closed <script> in the buffer
-                const openScriptIndex = buffer.indexOf("<script>");
-                if (openScriptIndex !== -1) {
-                  // We keep everything from the <script> onwards
-                  cutoffIndex = openScriptIndex;
-                } else {
-                  // B) If no open script, check if the end looks like a cut tag
-                  // Regex: Looks for '<' optionally followed by s, c, r, i, p, t AT THE END of the string ($)
-                  const partialTagMatch = buffer.match(/<s?c?r?i?p?t?$/);
-
-                  if (partialTagMatch) {
-                    // We save from where the suspicion starts
-                    cutoffIndex = partialTagMatch.index;
+                    if (line.startsWith("D:")) {
+                      try {
+                        const payload = JSON.parse(line.slice(2));
+                        if (payload.type === "redirect") {
+                          isRedirecting = true;
+                          window.location.href = isSafeRedirect(payload.url) ? payload.url : "/";
+                        } else if (payload.type === "cookie") {
+                          document.cookie = payload.cookie;
+                        }
+                      } catch (e) {
+                        console.error("[Dinou] Failed to parse stream command line:", e);
+                      }
+                    } else {
+                      cleanChunk += line + "\n";
+                    }
                   }
-                }
 
-                // 5. SEND SAFE CONTENT
-                const safeChunk = buffer.slice(0, cutoffIndex);
-                // What remains stays in the buffer for the next loop (chunk)
-                buffer = buffer.slice(cutoffIndex);
-
-                if (safeChunk) {
-                  controller.enqueue(encoder.encode(safeChunk));
+                  if (cleanChunk) {
+                    controller.enqueue(encoder.encode(cleanChunk));
+                  }
                 }
               }
             } catch (err) {
               controller.error(err);
             } finally {
-              // If it is NOT a redirect, we close. If it is a redirect, we leave hanging (your master trick).
               if (!isRedirecting) {
                 controller.close();
               }

package/dinou/core/server-function-proxy.js

@@ -1,6 +1,10 @@
 // public/server-function-proxy.js
 import { createFromFetch } from "@roggc/react-server-dom-esm/client";
 
+function isSafeRedirect(url) {
+  return typeof url === "string" && url.startsWith("/") && !url.startsWith("//");
+}
+
 export function createServerFunctionProxy(id) {
   return new Proxy(() => {}, {
     apply: async (_target, _thisArg, args) => {
@@ -31,15 +35,30 @@ export function createServerFunctionProxy(id) {
 
       if (!res.ok) throw new Error("Server function failed");
 
+      // Check header first
+      const redirectUrl = res.headers.get("X-Dinou-Redirect");
+      if (redirectUrl) {
+        window.location.href = isSafeRedirect(redirectUrl) ? redirectUrl : "/";
+        return new Promise(() => {});
+      }
+
       const contentType = res.headers.get("content-type") || "";
 
-      // Case 1: Pure HTML (Simple Redirect)
+      // Reject unexpected HTML responses entirely to prevent security bugs
       if (contentType.includes("text/html")) {
         const html = await res.text();
-        const range = document.createRange();
-        const documentFragment = range.createContextualFragment(html);
-        document.body.appendChild(documentFragment);
-        return new Promise(() => {});
+        console.warn("[Dinou] Received unexpected HTML response from server function:", html);
+        throw new Error("Unexpected HTML response from server function");
+      }
+
+      // Check if it's application/json (Scenario A clean redirect or json response)
+      if (contentType.includes("application/json")) {
+        const data = await res.json();
+        if (data && data.redirect) {
+          window.location.href = isSafeRedirect(data.redirect) ? data.redirect : "/";
+          return new Promise(() => {});
+        }
+        return data;
       }
 
       // Case 2: RSC or Hybrid Stream (Buffered)
@@ -47,7 +66,6 @@ export function createServerFunctionProxy(id) {
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         const encoder = new TextEncoder();
-        const scriptRegex = /<script>(.*?)<\/script>/gs;
 
         const readableStream = new ReadableStream({
           async start(controller) {
@@ -59,16 +77,20 @@ export function createServerFunctionProxy(id) {
                 const { done, value } = await reader.read();
 
                 if (done) {
-                  // If something remains in the buffer upon finishing, we send it (as long as it's not a broken script)
                   if (buffer.length > 0) {
-                    // CHECK: We search for the tag start, whether it has the closing > or not
-                    if (buffer.includes("<script")) {
-                      console.warn(
-                        "[Dinou] Stream ended with incomplete script. Discarding tail.",
-                      );
-                      // We do not enqueue.
+                    if (buffer.startsWith("D:")) {
+                      try {
+                        const payload = JSON.parse(buffer.slice(2));
+                        if (payload.type === "redirect") {
+                          isRedirecting = true;
+                          window.location.href = isSafeRedirect(payload.url) ? payload.url : "/";
+                        } else if (payload.type === "cookie") {
+                          document.cookie = payload.cookie;
+                        }
+                      } catch (e) {
+                        console.error("[Dinou] Failed to parse stream command line at end:", e);
+                      }
                     } else {
-                      // It is safe content (e.g., "a < b" or a cut JSON that React will handle)
                       controller.enqueue(encoder.encode(buffer));
                     }
                   }
@@ -78,65 +100,46 @@ export function createServerFunctionProxy(id) {
                 // 1. ACCUMULATE
                 buffer += decoder.decode(value, { stream: true });
 
-                // 2. PROCESS COMPLETE SCRIPTS
-                // We search for complete pairs of <script>...</script>
-                let match;
+                // 2. PROCESS COMPLETE LINES
+                const lastNewlineIndex = buffer.lastIndexOf("\n");
+                if (lastNewlineIndex !== -1) {
+                  const completeChunk = buffer.slice(0, lastNewlineIndex + 1);
+                  buffer = buffer.slice(lastNewlineIndex + 1);
 
-                // We execute all complete scripts we find
-                while ((match = scriptRegex.exec(buffer)) !== null) {
-                  const fullMatch = match[0];
-                  const scriptContent = match[1];
+                  const lines = completeChunk.split("\n");
+                  let cleanChunk = "";
 
-                  // Detect redirect
-                  if (scriptContent.includes("window.location.href")) {
-                    isRedirecting = true;
-                  }
-
-                  // Inject to DOM
-                  const range = document.createRange();
-                  const fragment = range.createContextualFragment(fullMatch); // fullMatch includes tags for correct context
-                  document.body.appendChild(fragment);
-                }
+                  for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (!line && i === lines.length - 1) {
+                      continue;
+                    }
 
-                // 3. CLEAN PROCESSED SCRIPTS FROM BUFFER
-                // Once executed, we remove them so they don't go to React
-                buffer = buffer.replace(scriptRegex, "");
-
-                // 4. CALCULATE WHAT IS SAFE TO SEND (The anti-cut logic)
-                // We need to know if the buffer ends with something that LOOKS like the start of a script
-                // Dangerous patterns at the end: <, <s, <sc, <scr, <scri, <scrip, <script
-
-                let cutoffIndex = buffer.length; // Default send everything
-
-                // A) If there is an open but not closed <script> in the buffer
-                const openScriptIndex = buffer.indexOf("<script>");
-                if (openScriptIndex !== -1) {
-                  // We keep everything from the <script> onwards
-                  cutoffIndex = openScriptIndex;
-                } else {
-                  // B) If no open script, check if the end looks like a cut tag
-                  // Regex: Looks for '<' optionally followed by s, c, r, i, p, t AT THE END of the string ($)
-                  const partialTagMatch = buffer.match(/<s?c?r?i?p?t?$/);
-
-                  if (partialTagMatch) {
-                    // We save from where the suspicion starts
-                    cutoffIndex = partialTagMatch.index;
+                    if (line.startsWith("D:")) {
+                      try {
+                        const payload = JSON.parse(line.slice(2));
+                        if (payload.type === "redirect") {
+                          isRedirecting = true;
+                          window.location.href = isSafeRedirect(payload.url) ? payload.url : "/";
+                        } else if (payload.type === "cookie") {
+                          document.cookie = payload.cookie;
+                        }
+                      } catch (e) {
+                        console.error("[Dinou] Failed to parse stream command line:", e);
+                      }
+                    } else {
+                      cleanChunk += line + "\n";
+                    }
                   }
-                }
 
-                // 5. SEND SAFE CONTENT
-                const safeChunk = buffer.slice(0, cutoffIndex);
-                // What remains stays in the buffer for the next loop (chunk)
-                buffer = buffer.slice(cutoffIndex);
-
-                if (safeChunk) {
-                  controller.enqueue(encoder.encode(safeChunk));
+                  if (cleanChunk) {
+                    controller.enqueue(encoder.encode(cleanChunk));
+                  }
                 }
               }
             } catch (err) {
               controller.error(err);
             } finally {
-              // If it is NOT a redirect, we close. If it is a redirect, we leave hanging (your master trick).
               if (!isRedirecting) {
                 controller.close();
               }

package/dinou/core/server.js

@@ -248,20 +248,24 @@ const appUseCookieParser = cookieParser();
 const app = express();
 app.use(appUseCookieParser);
 app.use(express.json());
+const { resolveRelativeUrl } = require("./url-resolver");
 
 function getContext(req, res) {
+  let hasRedirected = false;
   // Helper to execute res methods safely
   const safeResCall = (methodName, ...args) => {
+    if (hasRedirected) return;
     if (res.headersSent) {
+      if (methodName === "redirect" && req.path.includes("____rsc_payload")) {
+        return; // Silence streaming redirects during RSC payload requests
+      }
       console.log(
         `[Dinou] res.${methodName} called but headers already sent. Ignoring.`,
       );
-      // console.warn(
-      //   `[Dinou Warning] RSC Stream active. Ignoring res.${methodName}() to avoid crash.`
-      // );
       return; // Exit silently
     }
     if (methodName === "redirect") {
+      hasRedirected = true;
       // 1. Normalize arguments (Status and URL)
       let url = args[0];
       let status = 302; // Default
@@ -272,16 +276,27 @@ function getContext(req, res) {
       }
 
       function safeRedirect(targetUrl) {
-        // Validate it's a string before calling startsWith
+        const resolvedUrl = resolveRelativeUrl(targetUrl, req.path);
+        let finalUrl = "/";
         if (
-          typeof targetUrl === "string" &&
-          targetUrl.startsWith("/") &&
-          !targetUrl.startsWith("//")
+          typeof resolvedUrl === "string" &&
+          resolvedUrl.startsWith("/") &&
+          !resolvedUrl.startsWith("//")
         ) {
-          res.redirect.apply(res, [status, targetUrl]);
+          finalUrl = resolvedUrl;
         } else {
-          res.redirect.apply(res, [status, "/"]);
+          console.warn(
+            `[Dinou Security] Blocked unsafe redirect to: ${targetUrl}`,
+          );
+        }
+
+        if (req.path.includes("____rsc_payload")) {
+          res.setHeader("x-rsc-redirect", finalUrl);
+          res.status(200).end();
+          return;
         }
+
+        res.redirect.apply(res, [status, finalUrl]);
       }
       return safeRedirect(url);
     }
@@ -351,11 +366,31 @@ function getContextForServerFunctionEndpoint(req, res) {
     },
     res: {
       redirect: (urlOrStatus, url) => {
-        const targetUrl = url || urlOrStatus;
+        const rawUrl = url || urlOrStatus;
+        const referer = req.headers["referer"];
+        let refererPath = "/";
+        if (referer) {
+          try {
+            refererPath = new URL(referer).pathname;
+          } catch (e) {}
+        }
+        const resolvedUrl = resolveRelativeUrl(rawUrl, refererPath);
+        let finalUrl = "/";
+        if (
+          typeof resolvedUrl === "string" &&
+          resolvedUrl.startsWith("/") &&
+          !resolvedUrl.startsWith("//")
+        ) {
+          finalUrl = resolvedUrl;
+        } else {
+          console.warn(
+            `[Dinou Security] Blocked unsafe server function redirect to: ${rawUrl}`,
+          );
+        }
         // We throw a special object that the endpoint will intercept
         throw {
           $$type: "dinou-internal-redirect",
-          url: targetUrl,
+          url: finalUrl,
         };
       },
       status: (code) => {
@@ -380,7 +415,7 @@ function getContextForServerFunctionEndpoint(req, res) {
         }
 
         // SCENARIO B: Streaming active (Headers Sent)
-        // Inject JavaScript.
+        // Send safe stream command.
 
         // 🛑 Security: JS cannot write HttpOnly cookies
         if (options && options.httpOnly) {
@@ -404,11 +439,11 @@ function getContextForServerFunctionEndpoint(req, res) {
           if (options.sameSite) cookieStr += `; samesite=${options.sameSite}`;
         }
 
-        // Safe packaging for injection
+        // Safe packaging for stream command
         const safeCookieStr = JSON.stringify(cookieStr);
 
         // Write to stream
-        res.write(`<script>document.cookie = ${safeCookieStr};</script>`);
+        res.write(`D:{"type":"cookie","cookie":${safeCookieStr}}\n`);
       },
 
       clearCookie: (name, options) => {
@@ -421,13 +456,10 @@ function getContextForServerFunctionEndpoint(req, res) {
           return;
         }
 
-        // SCENARIO B: Script Injection
-        const safeName = JSON.stringify(name);
-        const safePath = JSON.stringify(path);
-
-        res.write(
-          `<script>document.cookie = ${safeName} + "=; Max-Age=0; path=" + ${safePath} + ";";</script>`,
-        );
+        // SCENARIO B: Custom stream command
+        const cookieStr = `${name}=; Max-Age=0; path=${path};`;
+        const safeCookieStr = JSON.stringify(cookieStr);
+        res.write(`D:{"type":"cookie","cookie":${safeCookieStr}}\n`);
       },
     },
   };
@@ -533,6 +565,11 @@ async function serveRSCPayload(req, res, isOld = false, isStatic = false) {
         isNotFound,
         isDevelopment,
       );
+
+      if (res.headersSent) {
+        return;
+      }
+
       const manifest = isDevelopment
         ? JSON.parse(
           readFileSync(
@@ -935,18 +972,17 @@ app.post("/____server_function____", async (req, res) => {
       } catch (err) {
         // 💡 WE INTERCEPT THE REDIRECT
         if (err && err.$$type === "dinou-internal-redirect") {
-          // 1. Always sanitize the URL
           const safeUrl = JSON.stringify(err.url);
-          const script = `<script>window.location.href = ${safeUrl};</script>`;
 
           if (!res.headersSent) {
-            // SCENARIO A: Clean (Content-Type html)
-            res.setHeader("Content-Type", "text/html");
-            return res.send(script); // res.send calls end() and return stops the function
+            // SCENARIO A: Clean (Content-Type application/json)
+            res.setHeader("Content-Type", "application/json");
+            res.setHeader("X-Dinou-Redirect", err.url);
+            return res.status(200).json({ redirect: err.url });
           } else {
-            // SCENARIO B: Dirty/Active Stream (Content-Type already set by clearCookie)
-            // Write the script to the existing stream
-            res.write(script);
+            // SCENARIO B: Dirty/Active Stream
+            // Write a custom line-based stream command
+            res.write(`D:{"type":"redirect","url":${safeUrl}}\n`);
 
             // ⚠️ IMPORTANT:
             // 1. We close the response, since we redirected and there will be no RSC payload.

package/dinou/core/url-resolver.js

@@ -0,0 +1,13 @@
+function resolveRelativeUrl(href, currentPathname) {
+  if (href.startsWith("/") || href.includes("://")) {
+    return href;
+  }
+  let base = currentPathname || "/";
+  if (!base.endsWith("/")) {
+    base += "/";
+  }
+  const resolved = new URL(href, "http://localhost" + base);
+  return resolved.pathname + resolved.search + resolved.hash;
+}
+
+module.exports = { resolveRelativeUrl };

package/dinou/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou-ejected",
-  "version": "4.0.11",
+  "version": "4.0.13",
   "main": "index.js",
   "private": true,
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou",
-  "version": "4.0.11",
+  "version": "4.0.13",
   "description": "Full-Stack React 19 framework with React Server Components, Server Functions, and Streaming SSR.",
   "main": "index.js",
   "bin": {