Similar to the allowRelative option for Joi.string().uri() but to mandate that the uri is relative.

Why?

A common use case for passing urls around in query string is to perform some subsequent redirection e.g.

http:\\www.example.com\do-something?returnUrl=\summary

It's very likely that you would only ever want the returnUrl to be relative to the current domain. Doing so can also prevent Open Redirection Attacks.

We are currently using the is-relative-url package to ensure the returnUrl is local.

Alternatively, Microsoft's C# algorithm looks like this (here's a blog which includes a coffeescript implementation of the same):

public static bool IsUrlLocalToHost(this HttpRequestBase request, string url)
{
   return !url.IsEmpty() &&
          ((url[0] == '/' && (url.Length == 1 ||
           (url[1] != '/' && url[1] != '\\'))) ||   // "/" or "/foo" but not "//" or "/\"
           (url.Length > 1 &&
            url[0] == '~' && url[1] == '/'));   // "~/" or "~/foo"
}

This could be useful to base something off (removing the tilde ~ logic as it is only relevent to ASP).

It would be nice if we could have Joi do this for us. Thoughts?