Unless you have open redirection on one of your routes you are right. CSP is the answer. https://chloe.re/2016/07/25/bypassing-paths-with-open-redirects-in-csp

Unless you have open redirection on one of your routes you are right. CSP is the answer. https://chloe.re/2016/07/25/bypassing-paths-with-open-redirects-in-csp/ https://chloe.re/2016/07/25/bypassing-paths-with-open-redire...