CakePHP return url validator
There is no need to urldecode() the url parameters, Cake does this for you. In fact,  you are decoding twice, which is usually a bug.

$url actually contains the hostname. That is very confusing and you should rename that.

Also, that is really deep nesting for such a simple piece of code and a lot of code duplication.

I implemented pretty much the same functionality once.

If you only want to redirect to internal resources, maybe an option would be to only allow relative urls (e. g. http://example.com/login?next=/dashboard). That would save you a lot of trouble:

$defaultRedirect = $this-&gt;Auth-&gt;redirect();                                                                          

if(empty($this-&gt;params['url']['next'])) {                                                                           
    return $this-&gt;redirect($defaultRedirect);                                                                        
}                                                                                                                    

$path = $this-&gt;params['url']['next'];                                                                                 

if (strpos($path, '/') === 0) {                                                                                       
    return $this-&gt;redirect($path);                                                                        
}                                                                                                                    

$this-&gt;redirect($defaultRedirect);


This also works around the inconsistencies of $_SERVER['SERVER_NAME'].

Why are you expecting weird urls?

Consider matching the path to your defined routes if you want to redirect to actions of your application only.