  def login_success
    if params[:ref].blank?
      redirect_to default_logged_in_path
    elsif params[:ref] =~ /^\//
      redirect_to params[:ref]
    else
      render "sns/login/redirect"
    end
  end
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.