Implemented correctly, there are no issues with this.
There are two things you should look out for (I assume that test
is not static here, but user supplied, so you eg want to upper-case every path):
- Open Redirect: If your redirect is implemented incorrectly, it might be possible for an attacker to redirect outside of your domain, which could be used in phishing attacks
- CSRF: If your CSRF protection is only a simple referer check (which isn't recommended), and if you have state-changing GET requests (which also is not recommended), those may be possible to exploit, depending on your implementation of the redirect mechanism
https://example.com/test
andhttps://example.com/Test
are different webpages on thehttps://example.com
site.history.replaceState(null, document.title, 'Test');